failed to download certificate from key vault using keyvault vm extension on windows VM

Copper Contributor

failed to download certificate from key vault using keyvault vm extension on windows VM

below is log on azure vm under folder C:\WindowsAzure\Logs\Plugins\Microsoft.Azure.KeyVault.KeyVaultForWindows\1.0.1082.9:

2020-01-26 17:24:00: <debug> [WindowsCertificateManager] TryWaitForContinuation: Wait returned WAIT_TIMEOUT..
2020-01-26 17:24:00: <info> [CertificateManager] Starting refreshing observed certificates...
2020-01-26 17:24:00: <info> [CertificateManager] Beginning refresh for:
2020-01-26 17:24:00: <info> [WindowsCertificateStore] attempting to open store 'LocalMachine\MY'
2020-01-26 17:24:00: <debug> [WindowsCertificateStore] opening the 'LocalMachine' store..
2020-01-26 17:24:00: <debug> [WindowsCertificateStore] store opened successfully.
2020-01-26 17:24:00: <debug> [AuthClient]  AcquireTokenCallback invoked
2020-01-26 17:24:00: <debug> [AuthClient]  acquiring token
2020-01-26 17:24:00: <debug> [MSIAuthClient]  acquiring token via MSI
2020-01-26 17:24:00: <debug> [MSIHttpClient]  MSI URL:
2020-01-26 17:24:00: <error> [CertificateManager] Refreshing '' failed with KeyVault exception: Unable to parse SecretBundle: missing ContenetType
2020-01-26 17:24:00: <error> [CertificateManager] Failed to download one or more certificates.
2020-01-26 17:24:00: <info> [WindowsCertificateManager] Checking state of termination event with a timeout of 300000


Thanks in advance

4 Replies

@bhanush880 You need to use the secrets path to the certificate because that'll make sure the download includes the private key as the certificate endpoint only includes the public key.




Keep in mind you do not need to add a secret in your Key Vault. simply making the URL change should allow the extension to download the correct certificate


Let me know if that works for you.








I just wanted to thank you for providing this solution as it has worked for me. Once I changed:





It worked fine, as indicated in the extension logs


Thank you


Hi ,

Working on azure key vault extension for windows. All the steps followed as per the documentation. But when the extension is running in the time interval below error is occurring.

Refreshing 'https://<keyvault-name>' failed with RequestException: 404; desc:
{"error":{"code":"SecretNotFound","message":"A secret with (name/id) CertificateName was not found in this key vault.

That works for me to, thank you very much, change */certificates/* to */secrets/*