Forum Discussion
failed to download certificate from key vault using keyvault vm extension on windows VM
failed to download certificate from key vault using keyvault vm extension on windows VM
below is log on azure vm under folder C:\WindowsAzure\Logs\Plugins\Microsoft.Azure.KeyVault.KeyVaultForWindows\1.0.1082.9:
2020-01-26 17:24:00: <debug> [WindowsCertificateManager] TryWaitForContinuation: Wait returned WAIT_TIMEOUT..
2020-01-26 17:24:00: <info> [CertificateManager] Starting refreshing observed certificates...
2020-01-26 17:24:00: <info> [CertificateManager] Beginning refresh for: https://keyvaultid.vault.azure.net/certificates/wildcard-company-com
2020-01-26 17:24:00: <info> [WindowsCertificateStore] attempting to open store 'LocalMachine\MY'
2020-01-26 17:24:00: <debug> [WindowsCertificateStore] opening the 'LocalMachine' store..
2020-01-26 17:24:00: <debug> [WindowsCertificateStore] store opened successfully.
2020-01-26 17:24:00: <debug> [AuthClient] AcquireTokenCallback invoked
2020-01-26 17:24:00: <debug> [AuthClient] acquiring token
2020-01-26 17:24:00: <debug> [MSIAuthClient] acquiring token via MSI
2020-01-26 17:24:00: <debug> [MSIHttpClient] MSI URL: http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&authority=https://login.windows.net/&resource=https://vault.azure.net
2020-01-26 17:24:00: <error> [CertificateManager] Refreshing 'https://keyvaultid.vault.azure.net/certificates/wildcard-company-com' failed with KeyVault exception: Unable to parse SecretBundle: missing ContenetType
2020-01-26 17:24:00: <error> [CertificateManager] Failed to download one or more certificates.
2020-01-26 17:24:00: <info> [WindowsCertificateManager] Checking state of termination event with a timeout of 300000
Thanks in advance
- jackjiang
Microsoft
bhanush880 You need to use the secrets path to the certificate because that'll make sure the download includes the private key as the certificate endpoint only includes the public key.
i.e. https://keyvaultid.vault.azure.net/secrets/wildcard-company-com
Keep in mind you do not need to add a secret in your Key Vault. simply making the URL change should allow the extension to download the correct certificate
Let me know if that works for you.
Thanks,
Jack
Hello
I just wanted to thank you for providing this solution as it has worked for me. Once I changed:
["https://<keyvault-name>.vault.azure.net/certificates/andrew-test"]
To
["https://<keyvault-name>.vault.azure.net/secrets/andrew-test"]
It worked fine, as indicated in the extension logs
Thank you
- That works for me to, thank you very much, change */certificates/* to */secrets/*
