Error “The parameter keyVaultCsmId has an invalid value” while adding App Service Certificates to KeyVault

Question

I have generated a wildcard certificate using Azure's App Service Certificate.

After this Azure asks you to configure the certificate in a KeyVault, and this is where I am getting stuck.

I have a Keyvault which is in the same region, same subscription, same resource group.

I have the necessary permissions to the key vault. I am a User Admin, Cert officer, Secrets officer, contributor to the key vault .

This step is failing with an error

Failed to link certificate with the selected Key Vault. Check below errors for more detail.

The Activity Log under App Service Certificate shows :

Operation Name : Add or Update Certificate

Status : Failed

Summary :

Operation name : Add or Update Certificate

Time stamp : Tue Jan 19 2021 07:10:46 GMT+1100 (Australian Eastern Daylight Time)

Event initiated by: xxxx

Error code: BadRequest

Message : The parameter keyVaultCsmId has an invalid value.

The JSON has the following important information :

"authorization": {
"action": "Microsoft.CertificateRegistration/certificateOrders/certificates/write",
"scope": "/subscriptions/xxx/resourceGroups/yyyyyyy/providers/Microsoft.CertificateRegistration/certificateOrders/InternalWildCard/certificates/InternalWildCard"
}

"properties": {
"statusCode": "BadRequest",
"serviceRequestId": null,
"statusMessage": "{\"Code\":\"BadRequest\",\"Message\":\"The parameter keyVaultCsmId has an invalid value.\",\"Target\":null,\"Details\":[{\"Message\":\"The parameter keyVaultCsmId has an invalid value.\"},{\"Code\":\"BadRequest\"},{\"ErrorEntity\":{\"ExtendedCode\":\"51008\",\"MessageTemplate\":\"The parameter {0} has an invalid value.\",\"Parameters\":[\"keyVaultCsmId\"],\"Code\":\"BadRequest\",\"Message\":\"The parameter keyVaultCsmId has an invalid value.\"}}],\"Innererror\":null}",
"eventCategory": "Administrative",
"entity": "/subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.CertificateRegistration/certificateOrders/InternalWildCard/certificates/InternalWildCard",
"message": "Microsoft.CertificateRegistration/certificateOrders/certificates/write",
"hierarchy": "xxxx"
    }

Any help on this or direction you can provide will be really appreciated :)

Theironrock95 Theironrock95 · Accepted Answer · 2021-01-18T20:36:16

In Azure Key Vault, supported certificate formats are PFX and PEM.

• .pem file format contains one or more X509 certificate files.

• .pfx file format is an archive file format for storing several cryptographic objects in a single file i.e. server certificate (issued for your domain), a matching private key, and may optionally include an intermediate CA.

Certificates used by App Service first needs to be converted to (and marked as) application/x-pkcs12. Re-importing the cert from a pfx file with the --password parameter (az keyvault certificate import), and after that import it from the key vault to the webapp might help. You may refer to this Blog might be helpful.

Also, look if Cert and the Key Vault are in their original resource group.

Additional details: https://docs.microsoft.com/en-us/azure/key-vault/certificates/tutorial-import-certificate

https://azure.github.io/AppService/2016/05/24/Deploying-Azure-Web-App-Certificate-through-Key-Vault.html

Error “The parameter keyVaultCsmId has an invalid value” while adding App Service Certificates to KeyVault

2 Answers