az network application-gateway root-cert create fails with keyvault url

## Describe the bug

**Command Name**
`az network application-gateway root-cert create`

**Errors:**
```

azure.core.pipeline.policies._universal : {
"status": "Failed",
"error": {
"code": "ApplicationGatewayKeyVaultSecretException",
"message": "Problem occured while accessing and validating KeyVault Secrets associated with Application Gateway '/subscriptions//resourceGroups/MC_-aks-test_westus2/providers/Microsoft.Network/applicationGateways/appgty-test'. See details below:",
"details": [
{
"code": "ApplicationGatewayTrustedRootCertificateInvalidData",
"message": "Data for certificate /subscriptions//resourceGroups/MC_-aks-test_westus2/providers/Microsoft.Network/applicationGateways/-appgty-test/trustedRootCertificates/backendtls is invalid."
}
]
}
}

File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-unpacked-wheel-0cx4jf6i\azure\core\polling\base_polling.py", line 500, in run
azure.core.exceptions.HttpResponseError: (ApplicationGatewayKeyVaultSecretException) Problem occured while accessing and validating KeyVault Secrets associated with Application Gateway '/subscriptions//resourceGroups/MC__westus2/providers/Microsoft.Network/applicationGateways/appgty-test'. See details below:

cli.azure.cli.core.azclierror : (ApplicationGatewayKeyVaultSecretException) Problem occured while accessing and validating KeyVault Secrets associated with Application Gateway '/subscriptions//resourceGroups/MC__westus2/providers/Microsoft.Network/applicationGateways/appgty-test'. See details below:
(ApplicationGatewayKeyVaultSecretException) Problem occured while accessing and validating KeyVault Secrets associated with Application Gateway '/subscriptions//resourceGroups/MC__westus2/providers/Microsoft.Network/applicationGateways/appgty-test'. See details below:
Event: Cli.PostExecute []
az_command_data_logger : exit code: 1
Command ran in 14.222 seconds (init: 0.230, invoke: 13.993)
telemetry.save : Save telemetry record of length 3321 in cach
```

## To Reproduce:
Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

- Create KV, add two certs with autorotation on for frontend & backend ssl in RG
- Create AKS cluster with AGIC using [this](https://azure.github.io/application-gateway-kubernetes-ingress/setup/install-new-windows-cluster/)
- Create an identity separately in a different resource group to access KV certs & assign the same as App Gty identity too
- AGIC identity has "Managed Identity Operator" role on this new identity
- create ssl cert with `az network application-gateway ssl-cert create -n frontend-tls --gateway-name $APP_GTY_NAME -g $AKS_RG_NAME --key-vault-secret-id $unversionedSecretId`
- TRY to create root cert using same `az network application-gateway root-cert create --gateway-name $APP_GTY_NAME -g $AKS_RG_NAME --name backend-tls --keyvault-secret $unversionedSecretId2`
- The secret ids look like 'https://kvName.vault.azure.net/secrets/backendcert' & 'https://kvName.vault.azure.net/secrets/frontendendcert'
## Expected Behavior
Should work fine & pull the cert from KV. **Surprisingly the frontend cert works but the backend one fails to be created**. I dont want to manually upload the cert as that breaks the auto rotation ideally.
## Environment Summary
```
Windows-10-10.0.19041-SP0
Python 3.6.8
Installer: MSI

azure-cli 2.17.1 *

Extensions:
account 0.2.1
aks-preview 0.4.72
application-insights 0.1.13
kusto 0.2.0

```
## Additional Context
Identity assigned to App Gty:
`
az network application-gateway identity show --gateway-name $APP_GTY_NAME -g $AKS_RG_NAME
{
"principalId": null,
"tenantId": null,
"type": "userAssigned",
"userAssignedIdentities": {
"/subscriptions/{removed}/resourcegroups/test/providers/Microsoft.ManagedIdentity/userAssignedIdentities/appgty-ssl-identity-test": {
"clientId": "ebb81e58-{removed}",
"principalId": "5d09d269-{removed}"
}
}
}
`
KV Access:
`appgty-ssl-identity-test` has access to get & list for all 3 secret, cert & key. And KV is set for all network access. Also to note the cert in KV is provided by a private CA authority.