Import-AzureKeyVaultCertificate does not work when attempting to move a pfx cert from one keyvault to another

Open

#9,485 opened on Jun 21, 2019 8 comments 1 reaction 1 assignee Claimed by @isra-fel View on GitHub

act-identity-squad Azure PS Team customer-reported feature-request Investigate :mag: KeyVault

Dominant language: C#
Stars: 4.8k
Forks: 4.3k
Avg merge: 2d 17h
Merged PRs (30d): 51

Description

## Description

CONTEXT: We are automating our pipeline to enable SSL binding for a webapp using custom hostnames. To do this, we need to import a certificate from an already existing shared vault. Ideally, I would be able to do this in memory as opposed to downloading the file onto the agent.

PROBLEM: When attempting to import this certificate using the documentation provided, I am getting the below errors for the scenarios outlined below. It appears this function does not support importing a certificate from another keyvault, even though the documentation indicates this can be done. Can you please provide an example, as they are not provided in the documentation to clearly articulate the use of a CertificateCollection and a CertificateString.

## Steps to reproduce

```
1.) Set up a shared keyvault with a pfx cert
2.) Add a secret to that shared vault using the naming convention: -password
3.) Set up a webapp
4.) Set up a custom hostname for which you wish to bind the cert
5.) run the script below passing in the proper parameters locally
```
```
<#
.SYNOPSIS

Enables the SSL state for a webapp that uses custom hostnames.

.DESCRIPTION

When provided a webapp name (the name of app which SSL is to be enabled), a prexisting keyvault name (where the SSL cert (.pfx) is stored) and a prexisting certificate name, the SSL state will become 'sniEnabled', and the SSL certificate will be bound to the webapp.

.PARAMETER WebappName
Specifies the name of the webapp resource for which SSL is to be enabled.
Default SSL state will be: 'sniEnabled'

.PARAMETER existingKeyvaultName
Specifies the name of the pre-existing shared keyvault containing the .pfx certificate that will be bind to your webapp.

.PARAMETER existingCertificateName
Specifies the name of the pre-existing certificate in the specified keyvault that will be bound to the webapp.

.INPUTS

This function does not support any piped inputs

.OUTPUTS

Returns status of the request to the keyvault, the request for the secret provided, and the status of the binding to the hostname.

.EXAMPLE
PS>
PS>

.LINK
http://linktoWiki
#>

function Enable-SslStateOnWebapp {
[CmdletBinding()]
param (
[Parameter(
Mandatory = $true,
HelpMessage = 'A webapp name is required.')]
[ValidateNotNullOrEmpty()]
[string] $WebappName,

[PARAMETER(
Mandatory = $true,
HelpMessage = 'The FQDN of the custom hostname you want to bind.')]
[ValidateNotNullOrEmpty()]
[string] $customWebappHostname,

[Parameter(
Mandatory = $true,
HelpMessage = 'A name for an existing Keyvault is required.')]
[ValidateNotNullOrEmpty()]
[string] $existingKeyvaultName,

[PARAMETER(
Mandatory = $true,
HelpMessage = 'A name of the pfx certificate stored in the pre-existing keyvault')]
[ValidateNotNullOrEmpty()]
[string] $existingKeyVaultCertName
)
#getting webapp resources
$webapp = Get-AzureRmResource -Name $webappName
#obtaining resource group resources through the use of resource group name tied to webapp
$rg = Get-AzureRmResource -ResourceGroupName $webapp.ResourceGroupName

#get cert from existing keyvault using provided parameters
$cert = Get-AzureKeyVaultSecret -VaultName $existingKeyvaultName -Name $existingKeyVaultCertName
$certFull = Get-AzureKeyVaultCertificate -VaultName $existingKeyvaultName -Name $existingKeyVaultCertName
if ($cert -eq $null) {
Throw "Unable to get the certificate: '$($existingKeyVaultCertName)' from the keyvault: '$($existingKeyvaultName)'. Please check that you have provided the correct vault and certificate name and try again."
}
#get cert password from existing keyvault using provided parameters
$password = Get-AzureKeyVaultSecret -VaultName $existingKeyVaultName -Name "$($existingKeyVaultCertName)-password"
if (-not $password) {
Throw "Unable to get the secret: '$($existingKeyVaultCertName)-password' from the keyvault: '$($existingKeyvaultName)'. Please check that you have provided the correct vault and password name and try again. Note: a secret stored in a keyvault that contains the password for a PFX certificate must be named in the following pattern '-password'."
}
if ($rg) {
#iterating over the resources and pulling those matching the appropriate resource type
$kv = $rg | Where-Object { $_.ResourceType -Match 'Microsoft.KeyVault/vaults' }
#iterating through the keyvaults and their access policies, looking for the keyvault that contains an access policy for the webapp.
$vaults = $kv | ForEach-Object {Get-AzureRmKeyVault -Name $_.Name}
$vaults | ForEach-Object {$_.accessPolicies } | ForEach-Object {
$a = $_
if($_.ObjectId -eq $webapp.Identity.PrincipalId){
Write-Host "Found the keyvault $($a.DisplayName)." -Verbose
$newKeyVaultName = $a.DisplayName.split(" ")[0]
}

}

#import the cert into a collection in memory
$certBytes = [System.Convert]::FromBase64String($cert.SecretValueText)
$certCollection = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection
$certCollection.Import($certBytes, $null, [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable)

#export the cert collection to the agent working directory
$protectedCertificateBytes = $certCollection.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pkcs12, $password.SecretText)
$certPath = "$(System.DefaultWorkingDirectory)/SslCert.pfx"
[System.IO.File]::WriteAllBytes($certPath, $protectedCertificateBytes)

#move the cert to a new keyvault as a certcollection
Import-AzureKeyVaultCertificate -VaultName $newKeyVaultName -Name $existingKeyVaultCertName -FilePath $certPath -password $password.SecretValue
#add the ssl binding to the webapp using the cert
New-AzureRmWebAppSSLBinding -ResourceGroupName $webApp.ResourceGroupName -WebAppName $webappName -Thumbprint $certFull.Thumbprint -Name $customWebappHostname -SslState "SniEnabled"

}
else {
Throw "Unable to obtain the resource group for the web application $($webappName). Please check the name any try again."
}
}
```

## Module versions

```
PS> (Get-Module -Name AzureRM* -ListAvailable)

Directory: /usr/local/share/powershell/Modules

ModuleType Version Name

---------- -------
Script
Script
Script 6.1.7
Script 0.1.8
Script 6.1.1
Script
Script 4.1.5
Script
Script 5.0.6
Script
Script 5.9.1
Script 0.3.7
Script
Script
Script 5.0.3
Script
Script 5.1.4
Script 6.2.1
Script 4.0.9
Script 5.1.0
Script 0.3.7
Script 0.7.0
Script 4.1.8
Script 5.1.5
Script 3.1.8
Script 5.2.1
Script 4.1.4
Script
Script 0.4.8
Script 0.2.7
Script
Script
Script 5.0.3
Script 5.0.6
Script 1.1.0
Script
Script 5.8.2
Script 4.1.9
Script 4.5.2
Script
Script 5.1.0
Script
Script 6.7.3
Script
Script
Script
Script 1.0.0
Script
Script 5.2.0
Script
Script 4.0.5
Script 4.1.3
Script 4.0.5
Script 5.2.0 PSEdition ExportedCom mands ---- --------- ----------- 6.13.1 AzureRM Desk 0.6.14 AzureRM.AnalysisServices Desk {Resume-... AzureRM.ApiManagement Desk {Add-Azu... AzureRM.ApplicationInsights Desk {Get-Azu... AzureRM.Automation Desk {Get-Azu... 4.0.11 AzureRM.Backup Desk {Backup-... AzureRM.Batch Desk {Remove-... 0.14.6 AzureRM.Billing Desk {Get-Azu... AzureRM.Cdn Desk {Get-Azu... 0.9.12 AzureRM.CognitiveServices Desk {Get-Azu... AzureRM.Compute Desk {Remove-... AzureRM.Consumption Desk {Get-Azu... 0.2.12 AzureRM.ContainerInstance Desk {New-Azu... 1.0.10 AzureRM.ContainerRegistry Desk {New-Azu... AzureRM.DataFactories Desk {Remove-... 0.5.11 AzureRM.DataFactoryV2 Desk {Set-Azu... AzureRM.DataLakeAnalytics Desk {Get-Azu... AzureRM.DataLakeStore Desk {Get-Azu... AzureRM.DevTestLabs Desk {Get-Azu... AzureRM.Dns Desk {Get-Azu... AzureRM.EventGrid Desk {New-Azu... AzureRM.EventHub Desk {New-Azu... AzureRM.HDInsight Desk {Get-Azu... AzureRM.Insights Desk {Get-Azu... AzureRM.IotHub Desk {Add-Azu... AzureRM.KeyVault Desk {Add-Azu... AzureRM.LogicApp Desk {Get-Azu... 0.18.5 AzureRM.MachineLearning Desk {Move-Az... AzureRM.MachineLearningCompute Desk {Get-Azu... AzureRM.MarketplaceOrdering Desk {Get-Azu... 0.10.4 AzureRM.Media Desk {Sync-Az... 6.11.1 AzureRM.Network Desk {Add-Azu... AzureRM.NotificationHubs Desk {Get-Azu... AzureRM.OperationalInsights Desk {New-Azu... AzureRM.PolicyInsights Desk {Get-Azu... 4.1.10 AzureRM.PowerBIEmbedded Desk {Remove-... AzureRM.profile Desk {Disable... AzureRM.RecoveryServices Desk {Get-Azu... AzureRM.RecoveryServices.Backup Desk {Backup-... 0.2.12 AzureRM.RecoveryServices.SiteRec... Desk {Edit-Az... AzureRM.RedisCache Desk {Remove-... 0.3.12 AzureRM.Relay Desk {New-Azu... AzureRM.Resources Desk {Get-Azu... 0.16.10 AzureRM.Scheduler Desk {Disable... 0.6.13 AzureRM.ServiceBus Desk {New-Azu... 0.3.15 AzureRM.ServiceFabric Desk {Add-Azu... AzureRM.SignalR Desk {New-Azu... 4.12.1 AzureRM.Sql Desk {Get-Azu... AzureRM.Storage Desk {Get-Azu... 4.0.10 AzureRM.StreamAnalytics Desk {Get-Azu... AzureRM.Tags Desk {Remove-... AzureRM.TrafficManager Desk {Add-Azu... AzureRM.UsageAggregates Desk Get-Usag... AzureRM.Websites Desk {Get-Azu...

```

## Error output

```
When attempting to import a cert using from another keyvault using a CertificateCollection:
Import-AzureKeyVaultCertificate -VaultName $newKeyVaultName -Name $existingKeyVaultCertName -CertificateCollection $certCollection

Import-AzureKeyVaultCertificate : Device not configured
At /grs-arm/enable-ssl_state_on_webapp/enable-ssl_state_on_webapp.ps1:100 char:9
+ Import-AzureKeyVaultCertificate -VaultName $newKeyVaultName - ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [Import-AzKeyVaultCertificate], SocketException
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.ImportAzureKeyVaultCertificate

When attempting to import a cert using a secure string and password:
Import-AzureKeyVaultCertificate -VaultName $newKeyVaultName -Name $existingKeyVaultCertName -CertificateString $certCollection -password $password.SecretText

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Import-AzureKeyVaultCertificate does not work when attempting to move a pfx cert from one keyvault to another

Description

Contributor guide

Assessment

Get new issues in your inbox