Apparently this works though the REST API, but is unfortunately neither exposed through the Portal UI nor through the .NET Client SDK. Also, it's not properly documented right now.
When you look at the example response for the Get Certificate Policy endpoint, you can see that it has a section "basic_constraints"
with the value you're looking for (even though it's not documented in the respective X509CertificateProperties section further down on the same page).
The property is however documented in the general "D509 props" documentation for the REST API. Mind the typo in path_len_contraint
though if you want to use that -- needs to be path_len_constraint
.
So when POSTing to https://<yourvault>.vault.azure.net/certificates/some-new-cert/create?api-version=7.0
using
"x509_props": {
...
"key_usage": [
"keyCertSign"
],
"basic_constraints": {
"ca": true,
"path_len_constraint": 3
}
},
it actually sets the values as expected. See Create Certificate documentation for other parameters.
The result can be seen in the openssl dump of the exported certificate:
X509v3 Key Usage: critical
Certificate Sign
X509v3 Basic Constraints: critical
CA:TRUE, pathlen:3