You can use the following CLI commands to add the secret to the existing vm:
secret=$(az keyvault secret list-versions \ --vault-name $keyvault_name \ --name mycert \ --query "[?attributes.enabled].id" --output tsv) vm_secret=$(az vm format-secret --secret "$secret") az vm update -n vmName -g resourceGroupName --set osProfile.secrets="$vm_secret"
Then the certificate stores on /var/lib/waagent, you could use Azure Custom Script to use it.
Note: You should use "$vm_secret", I test in my lab, only $vm_secret does not work for me.

You could use Azure Cli to do this. Using following command.
secret=$(az keyvault secret list-versions \ --vault-name $keyvault_name \ --name mycert \ --query "[?attributes.enabled].id" --output tsv) vm_secret=$(az vm format-secret --secret "$secret")
az vm update -n shui -g shuikeyvault --set osProfile.secrets="$vm_secret"
Then the certificate stores on `/var/lib/waagent`, you could use Azure Custom Script to use it.
Note: You should use `"$vm_secret"`, I test in my lab, only `$vm_secret` does not work for me.