"Authority Key Identifier Extension is malformed" when importing CA-signed certificate to Azure Key Vault

Malhar 0

When I try to import a CA-signed certificate to Azure Key Vault in both .pfx or .pem format, I'm getting the following error:

CODE BadParameter
MESSAGE The specified X.509 certificate content is invalid. Error: x.509 authority key identifier extension is malformed..

I have checked the certificate using openssl x509 -in certificate.pfx -text -noout and the authority key identifier extension values are different from each other.
So I would like to understand, is it necessary that both Subject Key Identifier & Authority Key Identifier values should be same? certificate_subject_authority_key

User's image

Navya 6,115 Reputation points Microsoft Vendor

2024-07-04T07:03:35.2866667+00:00

Hi @Malhar

Thank you for posting this in Microsoft Q&A.

I understand that you are trying import CA-signed certificate to Azure Key Vault, but you get an error "The specified X.509 certificate content is invalid. Error: x.509 authority key identifier extension is malformed".

Can you confirm which tool you have used to generate self-signed CA?

If you used OpenSSL or another tool to generate self-signed CA, you need to add the public certificate for that CA to the X509Store.

I would like to understand, is it necessary that both Subject Key Identifier & Authority Key Identifier values should be same?

In conforming CA certificates, the value of the subject key identifier MUST be the value placed in the key identifier field of the authority key identifier extension of certificates issued by the subject of this certificate.

For more information about Subject Key Identifier & Authority Key Identifier

Authority Key Identifier Subject Key Identifier

Hopes this helps. Do let us know if you any further queries.

Thanks,

Navya.
Malhar 0 Reputation points

2024-07-04T11:19:05.38+00:00

Hi Navya,

Referring to your first question, I have used openssl to generate a .csr(certificate signing request) file request in which first I generated a private key & based on that key I have generated a .csr file.
Afterwards, I provided that .csr file to the third party to sign & send us the new certificate.
So, as per my understanding, this process is not 'Self Signed' but its a 'Certificate issued by a non-integrated CA', am I correct on this?

Can you please let me know did I follow right process to generate the .csr, certificate from third party CA?

Share via

"Authority Key Identifier Extension is malformed" when importing CA-signed certificate to Azure Key Vault