How to Get Private Key from Certificate in an Azure Key Vault?

I have a Certificate in an Azure Key Vault that I would like to extract a private key from.

According to the Microsoft Docs:

When a Key Vault certificate is created, an addressable key and secret are also created with the same name. The Key Vault key allows key operations and the Key Vault secret allows retrieval of the certificate value as a secret.

However, I have been unsuccessful in extracting the private key from this. Here is an example of some python code I tried:

pem_data  = get_secret('https://keyvault.azure.net/', 'x509-cert')
pem_data = '-----BEGIN CERTIFICATE----- ' + pem_data + ' -----END CERTIFICATE-----'
pem_data = pem_data.encode()
key = x509.load_pem_x509_certificate(pem_data,  backend=default_backend())
private_key = key.private_key()

This however, will error saying it cannot load the certificate.

The pem_data you get from the key vault is already in pem format, and you can ony get the public key.

pem_data = client.get_secret("https://XX.vault.azure.net/", "XX", "XX")
pem_data = pem_data.value.encode()

cert = load_pem_x509_certificate(pem_data,  backend=default_backend())
public_key = cert.public_key()

If you want to get the private key, you can use OpenSSL:

import OpenSSL.crypto

pem_data = client.get_secret("https://XX.vault.azure.net/", "XX", "XX")
pem_data = pem_data.value.encode()
crtObj = crypto.load_certificate(crypto.FILETYPE_PEM, pem_data)
pubKeyObject = crtObj.get_pubkey()
priKeyString = crypto.dump_privatekey(crypto.FILETYPE_PEM, pubKeyObject)
print(priKeyString)

Note:

Please make sure that you have indicated that the key is exportable when you create the certificate. If the policy indicates non-exportable, then the private key isn't a part of the value when retrieved as a secret. Refer to this document for more details.