Certificate starts in the future

smeury commented 7 years ago

The first time I signed in to Azure Automation with the ISE addon I received this error (replaced the thumbprints with xxx):

Add-AzureRmAccount : AADSTS70002: Error validating credentials. AADSTS50012: Client assertion contains an invalid signature. [Reason - The key 
used is expired., Thumbprint of key used by client: 'xxx', Found key 'Start=04/08/2017, End=04/08/2018, 
Thumbprint=xxx', Configured keys: [Key0:Start=11/04/2016, End=11/05/2017, 
Thumbprint=xxx;Key1:Start=04/08/2017, End=04/08/2018, Thumbprint=xxx;]]
Trace ID: 7481fb7b-2d50-4b31-9745-b35d3ce14600
Correlation ID: d13c4f35-437f-40c8-870d-342b8bfb7f45
Timestamp: 2017-04-08 05:21:26Z
In Zeile:1 Zeichen:305
+ ... p 10;$Login=Add-AzureRmAccount -ServicePrincipal -TenantId $RunAsConn ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Add-AzureRmAccount], AdalServiceException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.AddAzureRMAccountCommand

Select-AzureRmSubscription : Run Login-AzureRmAccount to login.
In Zeile:1 Zeichen:487
+ ... Thumbprint};Select-AzureRmSubscription -SubscriptionId $RunAsConnecti ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [Set-AzureRmContext], PSInvalidOperationException
    + FullyQualifiedErrorId : InvalidOperation,Microsoft.Azure.Commands.Profile.SetAzureRMContextCommand

I found out that the certificate that was generated starts 2 hours in the future. After waiting for 2 hours I didn't receive this error again.

Maybe there is a problem with timezones?

eamonoreilly commented 7 years ago

Thanks for the feedback on this. It does seem like it could be a time zone issue. I'll have a look and see if I can tell what might cause this. Thanks, Eamon

justinmetz commented 7 years ago

We ran into this same issue in another project and solved it by setting the "NotBefore" property of the cert to a UTC based DateTime value at creation time.

$cert.NotBefore = [System.DateTime]::UtcNow

Hopefully this helps..

eamonoreilly commented 7 years ago

Thanks Justin - I'll give this a go and see if it resolves the issue. Eamon

woter324 commented 7 years ago

For some reason, it is still adding an hour to the certificate start time.

I'm in the UK, with the current time zone being British Summer Time = +1 GMT / UTC, but as you can see, from the following, the certificate time should start an hour earlier, not an hour later:

Get-Date = 01/07/2017 23:56:32

[DateTime]::Now = 07/01/2017 23:56:32

[DateTime]::UtcNow = 07/01/2017 22:56:32

Any ideas?

Thanks

andikrueger commented 7 years ago

There is still an issue with the start time of the certificate. I installed the ISE addon on a new system, with the following time values:

[DateTime]::Now = Dienstag, 3. Oktober 2017 13:17:51
[DateTime]::UtcNow = Dienstag, 3. Oktober 2017 11:17:51

The value of the certificate property "NotBefore" is: Dienstag, 3. Oktober 2017 15:03:19

Version of the toolkit:

Get-Module AzureAutomationAuthoringToolKit

ModuleType Version    Name                                ExportedCommands                                        
---------- -------    ----                                ----------------                                        
Script     0.2.3.8    AzureAutomationAuthoringToolkit     {Get-AutomationCertificate, Get-AutomationConnection,...

@eamonoreilly ~~Your change would solve this issue. As far as i can see, it did not make its way into the master branch of this repro. Can you check?~~ Was looking into the wrong file... Sorry.

andikrueger commented 7 years ago

Just a quick update: Downloading the latest sources and building it on my machine did resolve the issue. Prio this step the certificate property "NotBefore" was: [Now] + 2 hours. The certificates for the automation accounts did also have the wrong (future) date.

Following the link to the powershell gallery: The version over there is outdated compared to changes made for this issue

Version | Downloads | Last updated
AzureAutomationAuthoringToolkit 0.2.3.8 (this version) | 7320 | Thursday, February 16 2017

eamonoreilly commented 7 years ago

Thanks - I'll work on a new build so that the latest fixes can get onto the official release on PowerShell gallery.

eamonoreilly commented 7 years ago

New release is now live on https://www.powershellgallery.com/packages/AzureAutomationAuthoringToolkit/0.2.3.9 with this change incorporated. Thanks.

azureautomation / azure-automation-ise-addon

Certificate starts in the future #136