Azure Key Vault PFX import not showing correct certificate details

Question

I have problems with importing certificates into Azure Key Vault.

I have created a cert/fullchain/privatekey using Letsencrypt certbot.

Private key is a standard RSA 4096 key.

I have tried importing both fullchain+privatekey and certonly+privatekey, with same results.

Subject, Issuer, Serial Number and SAN are all empty.

Activation date, Expiration date, X509 SHA-1 Thumbprint, Key Identifier and Secret Identifier are all populated as expected.

If I try to use this in the custom domain in Azure Spring Apps, the domain does not serve a certificate, and I get SSL handshake error (I used openssl s_client to validate the certificate).

Can someone help me troubleshoot?

Why are certificates not properly populated when imported into Azure Key Vault?

Thanks!

Answer 1

Hi Neven Cvetkovic ,

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Issue:

You imported a PFX certificate into Azure Key Vault but several of the certificate details were missing. The Subject, Issuer, Serial Number and SAN fields were all empty. However, the Activation date, Expiration date, X509 SHA-1 Thumbprint, Key Identifier and Secret Identifier all populated as expected.

When you tried to use this in the custom domain in Azure Spring Apps, the domain would not serve a certificate, and you received an SSL handshake error.

Solution:

Using an RSA key instead of an ECDSA key resolved the issue.

See related Github issue.

If you have any other questions or are running into more Key Vault issues, please let me know.

Thank you again for your time and patience throughout this issue.

-

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 2

My bad.

It seems it was an ECDSA type key (default for Letsencrypt certbot), not a RSA key as I originally stated in the question.

The import requires you to use RSA key, instead of ECDSA key.