There is a command group 'az_keyvault_certificate'. This group of commands could 'manage certificates'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_keyvault_certificate_create'.The syntax is: az keyvault certificate create --name
                               --policy
                               --vault-name
                               [--disabled {false, true}]
                               [--tags]
                               [--validity]. The 1th example of the child command would be to use it to 'create a self signed certificate with the default policy and add it to a virtual machine', the syntax is: az keyvault certificate create --vault-name vaultname -n cert1 \
  -p "$(az keyvault certificate get-default-policy)"

secrets=$(az keyvault secret list-versions --vault-name vaultname \
  -n cert1 --query "[?attributes.enabled].id" -o tsv)

vm_secrets=$(az vm secret format -s "$secrets")

az vm create -g group-name -n vm-name --admin-username deploy  \
  --image Debian11 --secrets "$vm_secrets". The parameter '--name -n' is required. It is used to name of the certificate.. The parameter '--policy -p' is required. It is used to json encoded policy definition. use @{file} to load from a file(e.g. @my_policy.json).. The parameter '--vault-name' is required. It is used to name of the vault.. The parameter '--disabled' is optional. create certificate in disabled state.. The parameter '--tags' is optional. space-separated tags: key[=value] [key[=value] ...]. use "" to clear existing tags.. The parameter '--validity' is optional. number of months the certificate is valid for. overrides the value specified with --policy/-p.. 