I'm trying to sign a local CSR file with Azure KeyVault (HSMish cloud service), as well as creating a chained (signed by CA) certificate from it using "Bouncy Castle" for C# .NET Core.
I understand Azure KeyVault doesn't have a CA functionality but it enables you to use it for signing data with guarded keys.
My private key is stored in Azure KeyVault and now I'm trying to figure out what is the input of Sign(). Is it the entire CSR as a string/byte[]? Is it the SHA256 hash of the entire CSR?
Also, how do I inject the final signature to the new signed CSR / certificate, as well as creating a chain including the CA certificate that signed it?
Thanks