Error adding HTTPS certificate stored in Key Vault to Azure FrontDoor Classic: "Error: We were unable to read the private key for the certificate provided. The server (leaf) certificate private key may be corrupted."

Question

Error adding HTTPS certificate stored in Key Vault to Azure FrontDoor Classic: "Error: We were unable to read the private key for the certificate provided. The server (leaf) certificate private key may be corrupted."

楊済光 36

Hello,

I am encountering an issue while attempting to add an HTTPS certificate stored in Key Vault to Azure FrontDoor Classic. The specific error message I receive is as follows:

"Error: We were unable to read the private key for the certificate provided. The server (leaf) certificate private key may be corrupted."

Interestingly, when I utilize Azure FrontDoor Standard, I can successfully add the same certificate without any problems. This issue seems to be isolated to Azure FrontDoor Classic.

I would greatly appreciate any assistance or insights into resolving this issue. Thank you very much.

GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-06-29T12:31:02.2433333+00:00
Hello @楊済光 ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you are unable to add an HTTPS certificate stored in Key Vault to Azure Front Door Classic as it fails with an error "We were unable to read the private key for the certificate provided. The server (leaf) certificate private key may be corrupted".

However, you are able to successfully add the same certificate to Azure Front Door Standard.

Since the same certificate is working with Azure Front Door Standard, I'm assuming the certificate has no issues and it is from a PFX file, which uses the application/x-pkcs12 content type. And the certificate is uploaded as a certificate object, rather than a secret, which was created as a complete certificate chain with an allowed certificate authority (CA).

Refer: https://learn.microsoft.com/en-us/azure/frontdoor/domain#certificate-requirements

https://learn.microsoft.com/en-us/azure/key-vault/certificates/tutorial-import-certificate?tabs=azure-portal

So, let us first check a few details to make sure that the configuration is correct.

Is the key vault account in the same Azure subscription as your Azure Front Door Classic?

Have you registered the service principal for Azure Front Door Classic as an app in your Azure Active Directory (Azure AD) by using Azure PowerShell or the Azure CLI. Azure Front Door (classic) has a different Application Id than Azure Front Door Standard/Premium tier.

So, make sure that the Application Id of Azure Front Door Classic is registered as below:

Azure PowerShell:

New-AzADServicePrincipal -ApplicationId "ad0e1c7e-6d38-4ba4-9efd-0bc77ba9f037"

Azure CLI:

az ad sp create --id ad0e1c7e-6d38-4ba4-9efd-0bc77ba9f037

Refer: https://learn.microsoft.com/en-us/azure/frontdoor/front-door-custom-domain-https#prepare-your-key-vault-and-certificate

Also, make sure that your Azure Front Door Classic has access to your key vault following the below doc:

https://learn.microsoft.com/en-us/azure/frontdoor/front-door-custom-domain-https#grant-azure-front-door-access-to-your-key-vault

I've also seen this error when there are improper store flags while importing the certificate to either remove password or during upload to key vault. So, if the above configuration is done properly, we will proceed further to validate the certificate.

Regards,

Gita
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
楊済光 36 Reputation points

2023-06-30T00:52:17.9933333+00:00

Dear @GitaraniSharma-MSFT ,

I would like to express my sincere gratitude for your prompt response to my inquiry regarding the error I encountered while attempting to retrieve an SSL certificate. Your assistance is greatly appreciated.

I wanted to provide some additional information regarding the issue. As per your suggestion, we followed the method described in your documentation to set the permissions for the key vault. Specifically, we granted the "get-secret" permission to the service principal with the object ID ad0e1c7e-6d38-4ba4-9efd-0bc77ba9f037. However, despite implementing these steps, we are still encountering the same error.

Furthermore, I would like to mention that this error has only recently emerged. Until at least two weeks ago, we were able to successfully retrieve the certificates stored in the key vault without any issues.

Lastly, I would like to confirm that the certificates stored in the key vault are indeed in PFX format, as you mentioned. Additionally, they meet all the legitimate requirements outlined in the documentation.

Once again, thank you for your assistance and prompt attention to this matter. I look forward to any further guidance or suggestions you may have to help us resolve this issue.

Best regards,

楊済光
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Carlos 25 Reputation points

2023-06-30T02:46:40.33+00:00

I currently have a support ticket open for exactly this issue.
"Failed to update the custom https configuration for the frontend host '......'. Error: We were unable to read the private key for the certificate provided. The server (leaf) certificate private key may be corrupted."

Existing certs generated with the same script are OK
Cert works on standard, and app gateway, but not classic
Issue is able to be replicated in a different subscription
I suspect a change in the last 4-6weeks (perhaps related to the AFD stricter certificate validation change??)

I'll post an update when I have new information.
roman.ostolosh 0 Reputation points

2023-06-30T11:50:18.5466667+00:00

I'm having the exact same issue with FrontDoor Classic.

I'm having it with wildcard domains that I need to bind using our own certificates.

I've also tried unbinding and re-binding the exact same certificate that were bound and worked correctly and this fails with the aforementioned error.
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-06-30T12:05:25.01+00:00

Hello @楊済光 ,

Thank you for sharing the additional details.

This seems to be an ongoing issue/bug with multiple customers.

I'm following up with the Azure Front Door Product Group team regarding this issue. I will get back to you as soon as I get an update on this.

Regards,

Gita
John 10 Reputation points

2023-06-30T12:40:27.37+00:00
I'm seeing this too. First noticed it last Friday (23rd) June. Up to that point there was no issue with Front Door Classic enabling https on the provided domain, using a cert in KeyVault.

I have gone through the following checklist and there is nothing unusual or wrong:

The certificate is bundled correctly with the root, intermediate, and leaf certs.

Certificate has the private key included in the pfx.

Certificate is issued by an accepted root CA

Certificate is not expired

Certificate is uploaded as a certificate object in KeyVault, not as a secret.

3 answers

Your answer

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
楊済光 36 Reputation points

2023-06-30T00:52:17.9933333+00:00

Dear @GitaraniSharma-MSFT ,

I would like to express my sincere gratitude for your prompt response to my inquiry regarding the error I encountered while attempting to retrieve an SSL certificate. Your assistance is greatly appreciated.

I wanted to provide some additional information regarding the issue. As per your suggestion, we followed the method described in your documentation to set the permissions for the key vault. Specifically, we granted the "get-secret" permission to the service principal with the object ID ad0e1c7e-6d38-4ba4-9efd-0bc77ba9f037. However, despite implementing these steps, we are still encountering the same error.

Furthermore, I would like to mention that this error has only recently emerged. Until at least two weeks ago, we were able to successfully retrieve the certificates stored in the key vault without any issues.

Lastly, I would like to confirm that the certificates stored in the key vault are indeed in PFX format, as you mentioned. Additionally, they meet all the legitimate requirements outlined in the documentation.

Once again, thank you for your assistance and prompt attention to this matter. I look forward to any further guidance or suggestions you may have to help us resolve this issue.

Best regards,

楊済光
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Carlos 25 Reputation points

2023-06-30T02:46:40.33+00:00

I currently have a support ticket open for exactly this issue.
"Failed to update the custom https configuration for the frontend host '......'. Error: We were unable to read the private key for the certificate provided. The server (leaf) certificate private key may be corrupted."

Existing certs generated with the same script are OK
Cert works on standard, and app gateway, but not classic
Issue is able to be replicated in a different subscription
I suspect a change in the last 4-6weeks (perhaps related to the AFD stricter certificate validation change??)

I'll post an update when I have new information.
roman.ostolosh 0 Reputation points

2023-06-30T11:50:18.5466667+00:00

I'm having the exact same issue with FrontDoor Classic.

I'm having it with wildcard domains that I need to bind using our own certificates.

I've also tried unbinding and re-binding the exact same certificate that were bound and worked correctly and this fails with the aforementioned error.
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-06-30T12:05:25.01+00:00

Hello @楊済光 ,

Thank you for sharing the additional details.

This seems to be an ongoing issue/bug with multiple customers.

I'm following up with the Azure Front Door Product Group team regarding this issue. I will get back to you as soon as I get an update on this.

Regards,

Gita
John 10 Reputation points

2023-06-30T12:40:27.37+00:00

I'm seeing this too. First noticed it last Friday (23rd) June. Up to that point there was no issue with Front Door Classic enabling https on the provided domain, using a cert in KeyVault.

I have gone through the following checklist and there is nothing unusual or wrong:

The certificate is bundled correctly with the root, intermediate, and leaf certs.

Certificate has the private key included in the pfx.

Certificate is issued by an accepted root CA

Certificate is not expired

Certificate is uploaded as a certificate object in KeyVault, not as a secret.

Answer 1

Carlos 25

It would seem the issue was caused by a recent change to Frontdoor classic. I believe the issue is now fixed and (for me at least) certs can now be provisioned from keyvault

Rafael Gil Sanchez 106 Reputation points

2023-07-03T05:08:21.0733333+00:00

Yes, its true.

My problem was solved too.

https://learn.microsoft.com/en-us/answers/questions/1321315/problem-adding-certificate-to-subdomain-in-azure-f

I can set my certificate on my subdomains on frontdoor (Classic) now.

Thanks for update Carlos.
John 10 Reputation points

2023-07-03T10:14:36.0666667+00:00

This is now working for me too.

Answer 2

Hello @楊済光 ,

I understand that you were unable to add an HTTPS certificate stored in Key Vault to Azure Front Door Classic as it was failing with an error "We were unable to read the private key for the certificate provided. The server (leaf) certificate private key may be corrupted".

I checked internally and found that this is an ongoing issue affecting multiple customers.

I reached to the Azure Front Door Product Group team for more information and below is the update:

The Azure Front Door team mentioned that there was a recent deployment which caused this issue, so they have rolled back that deployment now. And you should be able to add HTTPS certificate from Key Vault to Azure Front Door Classic without any issues.

Request you to try to add the certificate again and let us know if you face any issues.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 3

Anonymous

I am having a similar issue with Microsoft Frontdoor Standard where I am not able to import the certificate from the Azure key vault

az keyvault secret show --name <name> --vault-name <vault name> --query contentType

"application/x-pkcs12"

Code="BadRequest" Message="The secret contains an unsupported content type. The content type needs to be application/x-pkcs12."

Any help with this is much appreciated.

GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-09-27T07:41:44.48+00:00
Hello @Anonymous ,

Please make sure that your certificate meets the below requirements:

Complete certificate chain: When you create your TLS/SSL certificate, you must create a complete certificate chain with an allowed certificate authority (CA) that is part of the Microsoft Trusted CA List. If you use a non-allowed CA, your request will be rejected. The root CA must be part of the Microsoft Trusted CA List. If a certificate without complete chain is presented, the requests that involve that certificate aren't guaranteed to work as expected.

Common name: The common name (CN) of the certificate must match the domain configured in Azure Front Door.

Algorithm: Azure Front Door doesn't support certificates with elliptic curve (EC) cryptography algorithms.

File (content) type: Your certificate must be uploaded to your key vault from a PFX file, which uses the application/x-pkcs12 content type.

Certificates must be uploaded as a certificate object to the Key Vault, rather than a secret.

Refer: https://learn.microsoft.com/en-us/azure/frontdoor/domain?pivot=front-door-standard-premium#certificate-requirements

Regards,

Gita

Share via

Error adding HTTPS certificate stored in Key Vault to Azure FrontDoor Classic: "Error: We were unable to read the private key for the certificate provided. The server (leaf) certificate private key may be corrupted."

3 answers

Your answer