[keyvault-certificates] Fix begin_create_certificate validator to accept san_ip_addresses and san_uris

[rohitsinghal4u]

Summary

Fixes a bug where CertificateClient.begin_create_certificate (and its async counterpart create_certificate) incorrectly raised ValueError when a CertificatePolicy was created with only san_ip_addresses or san_uris (with no subject, san_dns_names, san_emails, or san_user_principal_names).

IP addresses and URIs are valid Subject Alternative Name (SAN) types and should be accepted by the client's policy validator.

Root Cause

The validator in both _client.py and aio/_client.py checked:

if not (policy.san_emails or policy.san_user_principal_names or policy.san_dns_names or policy.subject):
    raise ValueError(NO_SAN_OR_SUBJECT)

san_ip_addresses and san_uris were missing from this condition.

Changes

• azure/keyvault/certificates/_client.py — added san_ip_addresses and san_uris to the validator condition in begin_create_certificate
• azure/keyvault/certificates/aio/_client.py — same fix for the async client's create_certificate
• CHANGELOG.md — added 4.11.1 (Unreleased) section documenting the fix
• tests/test_certificates_client.py — extended test_policy_expected_errors_for_create_cert to assert IP/URI-only policies no longer raise; added test_create_certificate_with_san_ip_and_uris live test (recorded)
• tests/test_certificates_client_async.py — same test additions for the async client
• tests/_test_case.py and tests/_async_test_case.py — fixed a secondary issue where empty-string values for AZURE_CLIENT_ID/AZURE_CLIENT_SECRET were set into the environment, causing newer versions of azure-identity's EnvironmentCredential (which checks is not None rather than truthiness) to attempt and fail ClientSecretCredential construction during developer auth. Now empty-string KEYVAULT_* vars cause the corresponding AZURE_* vars to be removed from the env, allowing DefaultAzureCredential to fall through to AzureCliCredential.
• assets.json — updated tag to python/keyvault/azure-keyvault-certificates_a5c5c34814 (new recordings pushed)

Testing

• Both new live tests recorded against https://kv-sdk-test-5903.vault.azure.net/
• Both pass in playback mode
• test_policy_expected_errors_for_create_cert (sync + async) updated and verified

[Copilot]

Pull request overview

Fixes Key Vault Certificates client-side policy validation so SAN-only policies using IP addresses and/or URIs are accepted, and adds coverage + recordings to prevent regressions.

Changes:

• Update sync/async certificate creation validators to treat san_ip_addresses and san_uris as satisfying the “SAN or subject required” rule.
• Add unit assertions and new live tests (sync + async) validating IP/URI-only SAN policies; refresh test recordings/assets tag.
• Adjust live-test credential environment-variable handling to avoid empty-string AZURE_* values interfering with DefaultAzureCredential.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
sdk/keyvault/azure-keyvault-certificates/azure/keyvault/certificates/_client.py	Expands validator to include san_ip_addresses and san_uris.
sdk/keyvault/azure-keyvault-certificates/azure/keyvault/certificates/aio/_client.py	Same validator expansion for async create_certificate.
sdk/keyvault/azure-keyvault-certificates/tests/test_certificates_client.py	Adds sync live test + extends validator-behavior assertions.
sdk/keyvault/azure-keyvault-certificates/tests/test_certificates_client_async.py	Adds async live test + extends validator-behavior assertions.
sdk/keyvault/azure-keyvault-certificates/tests/_test_case.py	Avoids setting empty-string AZURE_* env vars during live tests.
sdk/keyvault/azure-keyvault-certificates/tests/_async_test_case.py	Same env-var adjustment for async tests.
sdk/keyvault/azure-keyvault-certificates/CHANGELOG.md	Documents the fix in 4.11.1 section.
sdk/keyvault/azure-keyvault-certificates/assets.json	Updates assets tag for new recordings.
sdk/keyvault/azure-keyvault-keys/azure/keyvault/keys/_models.py	Changes KeyProperties.tags typing to Optional[Dict[str, str]] (appears unrelated to this PR’s stated scope).

[rohitsinghal4u]

/check-enforcer override

[rohitsinghal4u]

/check-enforcer override

[rohitsinghal4u]

/check-enforcer override

[kashifkhan]

/check-enforcer override

[scbedd]

/azp run python - pullrequest

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[rohitsinghal4u]

/check-enforcer override

[rohitsinghal4u]

Hi @kashifkhan, the code is all merged and the CHANGELOG is set to \4.11.1 (2026-04-29). Could you please trigger the release pipeline to publish this to PyPI? Thanks!