Import-AzKeyVaultCertificate yields Cannot find the requested object

cveld commented 2 years ago

Description

When running the cmdlet Import-AzKeyVaultCertificate it yields the error Cannot find the requested object.

import-azkeyvaultcertificate -VaultName myvault -name examplecert -FilePath C:\temp\cert\examplecert.pem

I expect the certificate to be imported.

Interestingly when running the az cli counterpart, this runs fine:

az keyvault certificate import --vault-name myvault -n examplecert -f C:\temp\cert\examplecert.pem

Contents of examplecert.pem:

Issue script & Debug output

DEBUG: 10:25:05 PM - ImportAzureKeyVaultCertificate begin processing with ParameterSet 'ImportCertificateFromFile'.
DEBUG: 10:25:05 PM - using account id '<redacted>'...
Import-AzKeyVaultCertificate: Cannot find the requested object.

Environment data

$psversiontable

Name                           Value
----                           -----
PSVersion                      7.2.4
PSEdition                      Core
GitCommitId                    7.2.4
OS                             Microsoft Windows 10.0.22000
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Module versions

Script     4.4.0                 Az.KeyVault

Error output

HistoryId: 57

[32;1mMessage        : [0mCannot find the requested object.
[32;1mStackTrace     : [0m   at Internal.Cryptography.Pal.StorePal.FromBlobOrFile(ReadOnlySpan`1 rawData, String fileName, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)
[32;1m                 [0m   at System.Security.Cryptography.X509Certificates.X509Certificate2Collection.Import(String fileName, String password, X509KeyStorageFlags keyStorageFlags)
[32;1m                 [0m   at Microsoft.Azure.Commands.KeyVault.ImportAzureKeyVaultCertificate.InitializeCertificateCollection()
[32;1m                 [0m   at Microsoft.Azure.Commands.KeyVault.ImportAzureKeyVaultCertificate.ExecuteCmdlet()
[32;1m                 [0m   at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.<>c__3`1.<ExecuteSynchronouslyOrAsJob>b__3_0(T c)
[32;1m                 [0m   at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.ExecuteSynchronouslyOrAsJob[T](T cmdlet, Action`1 executor)
[32;1m                 [0m   at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.ExecuteSynchronouslyOrAsJob[T](T cmdlet)
[32;1m                 [0m   at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord()
[32;1mException      : [0mInternal.Cryptography.CryptoThrowHelper+WindowsCryptographicException
[32;1mInvocationInfo : [0m{Import-AzKeyVaultCertificate}
[32;1mLine           : [0mimport-azkeyvaultcertificate -VaultName myvault -name examplecert -FilePath C:\temp\cert\examplecert.pem
[32;1mPosition       : [0mAt line:1 char:1
[32;1m                 [0m+ import-azkeyvaultcertificate -VaultName myvault -name examplecert - …
[32;1m                 [0m+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[32;1mHistoryId      : [0m57

(what is the best way to suppress these TTY commands?)

dingmeng-xue commented 2 years ago

@BethanyZhou , please help to look into this issue.

isra-fel commented 2 years ago

Hi @cveld we want to know more about your scenario - were you importing a pre-created certificate to Azure KeyVault, or trying to create a new certificate in KeyVault? I asked because both scenarios involve importing a cert, but their implementation is totally different.

cveld commented 2 years ago

@isra-fel We pre-created it with the openssl tooling.

New-Item -Path $OutputPath -ItemType Directory -Force
openssl genrsa -aes256 -passout pass:1234 -out $OutputPath\root.key.pem 2048

$here = Split-Path $MyInvocation.MyCommand.Path -Parent
$cnffile = Join-Path -Path $here -ChildPath "..\Configs\root-ca.cnf"
openssl req -new -x509 -config $cnffile -passin pass:1234 -key $OutputPath\root.key.pem -subj "/CN=My org" -days 3650 -sha256 -extensions v3_ca -out $OutputPath\root.cert.pem
openssl x509 -passin pass:1234 -noout -text -in $OutputPath\root.cert.pem

openssl pkcs8 -passin pass:1234 -nocrypt -in $OutputPath\root.key.pem -topk8 -out $OutputPath\root.pem

$from = Get-Content -Path $OutputPath\root.cert.pem
Add-Content -Path $OutputPath\root.pem -Value $from

# OpenSSL root CA configuration file.

[ ca ]
default_ca = CA_default

[ CA_default ]
# Directory and file locations.
dir               = .
certs             = certs
crl_dir           = crl
new_certs_dir     = newcerts
database          = index.txt
serial            = serial
RANDFILE          = .rand

# The root key and root certificate.
private_key       = root/myprivatekey.key.pem
certificate       = root/mycertificate.cert.pem

# For certificate revocation lists.
crlnumber         = $dir/crlnumber
crl               = $dir/crl/azure-iot-test-only.intermediate.crl.pem
crl_extensions    = crl_ext
default_crl_days  = 30

# SHA-1 is deprecated, so use SHA-2 instead.
default_md        = sha256

name_opt          = ca_default
cert_opt          = ca_default
default_days      = 375
preserve          = no
policy            = policy_loose

[ policy_strict ]
# The root CA should only sign intermediate certificates that match.
countryName             = optional
stateOrProvinceName     = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ policy_loose ]
# Allow the intermediate CA to sign a more diverse range of certificates.
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ req ]
default_bits        = 2048
distinguished_name  = req_distinguished_name
string_mask         = utf8only

# SHA-1 is deprecated, so use SHA-2 instead.
default_md          = sha256

# Extension to add when the -x509 option is used.
x509_extensions     = v3_ca

[ req_distinguished_name ]
# See <https://en.wikipedia.org/wiki/Certificate_signing_request>.
countryName                     = Country Name (2 letter code)
stateOrProvinceName             = State or Province Name
localityName                    = Locality Name
0.organizationName              = Organization Name
organizationalUnitName          = Organizational Unit Name
commonName                      = Common Name
emailAddress                    = Email Address

# Optionally, specify some defaults.
countryName_default             = US
stateOrProvinceName_default     = WA
localityName_default            =
0.organizationName_default      = My Organization
organizationalUnitName_default  =
emailAddress_default            =

[ v3_ca ]
# Extensions for a typical CA.
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ v3_intermediate_ca ]
# Extensions for a typical intermediate CA.
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ usr_cert ]
# Extensions for client certificates.
basicConstraints = CA:FALSE
nsCertType = client, email
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, emailProtection

[ server_cert ]
# Extensions for server certificates.
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth

[ crl_ext ]
# Extension for CRLs.
authorityKeyIdentifier=keyid:always

[ ocsp ]
# Extension for OCSP signing certificates.
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, digitalSignature
extendedKeyUsage = critical, OCSPSigning

isra-fel commented 2 years ago

Got it @cveld , thanks. @BethanyZhou is working on this. We are targeting the July 5th release.

Azure / azure-powershell