Why do I get 'Certificate cannot be referenced by thumbprint'

Question

Hi,

When configuring API to use client certificate for gateway authentication I get this error.

One or more fields contain incorrect values:
Error in element 'authentication-certificate' on line 4, column 10: The Certificate with id 'test-cert' and thumbprint '...' is configured with KeyVault secret '...' and cannot be referenced by thumbprint. Please reference it with certificate-id 'test-cert' in the policy.

I've followed this guide:
https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-mutual-certificates

Using a self-signed certificate created in Azure Key Vault.

Have configured Azure RBAC access.

Also I'm using API Management Consumption Tier.

How can I solve this? Is there a way to reference it with certificate-id instead?

Answer 1

Hi Fredrik Visterlind,

Thank you for reaching out on Microsoft Q&A!

Indeed, you found the correct solution yourself by providing the certificate-id instead of the thumbprint. Reason for this being: when a new certificate is enrolled your thumbprint may change but your id does not. Therefor you don't have to replace your certificate in-code each time a new certificate is enrolled.

Even though you found the solution yourself I did want to elaborate more on it for you and other to make sense on why this is necessary :-)

Please click “Accept answer” if you find this helpful. Feel free to drop additional queries in the comments below!

Kind regards,

Sonny

Answer 2

@Fredrik Visterlind

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others", I'll repost your solution in case you'd like to accept the answer.

Error Message:

One or more fields contain incorrect values: Error in element 'authentication-certificate' on line 4, column 10: 

The Certificate with id 'test-cert' and thumbprint '...' is configured with KeyVault secret '...' and cannot be referenced by thumbprint. Please reference it with certificate-id 'test-cert' in the policy.

Issue:

When trying to secure your backend services using client certificate authentication in Azure API Management, you were running into the above error when configuring your API to use the certificate for gateway authentication.

Solution:

In order to resolve your issue, you added the certificate-id within your code.

<policies>
    <inbound>
        <base />
        <set-backend-service id="apim-generated-policy" backend-id="WebApp_test-app" />
        <authentication-certificate certificate-id="test-cert" />
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <base />
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

If I missed anything please let me know and I'd be happy to add it to my answer, or feel free to comment below with any additional information.

---

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.