-
Notifications
You must be signed in to change notification settings - Fork 2.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
az keyvault certificate create unable to set X509 Certificate properties Basic Constraints CA = true #18178
Comments
key vault |
Not supported by service, feature request here Azure/azure-rest-api-specs#11962 (comment) #please-close |
@jlichwa instead of closing, it it possible to convert this issue into a feature request? For Azure CLI. |
@tringuyen-yw CLI team cannot do anything without feature first implemented by a service: link above. Once service supports we always release it to all clients, so no need to create issue for each client |
It seems that it is already working with RESP API. Can you run the |
@tringuyen-yw it is for internal use only and not supported for public use, it has unknown behavior. |
Describe the bug
The goal is to create a self-signed x509 certificate to be used as our own Certificate Authority certificate. The generated certificate must have the x509v3 Basic Constraints property named
CA
to be set totrue
.The issue is the impossibility to use
az keyvault certificate create
to set that value. Even if it is explicitly defined in the certificate policy. As of 2021-05-20, the only way to set that value is to use the REST API as described here. A working REST API call is supplied in the "Expected Behavior" section.Command Name
az keyvault certificate create ...
see details in "To Reproduce" sectionThe command successfully created a certificate. But the x509v3 Basic Constraints have the
CA
property set tofalse
regardless of the value supplied in the JSON of the certificate policy.To Reproduce:
Content of
MyCertPolicy.json
. Please note the sectionbasic_constraints
with"ca": true
Download the certificate and verify its x509 properties
Notice the output shows
X509v3 Basic Constraints: CA: FALSE
Expected Behavior
X509v3 Basic Constraints should be
CA:TRUE
as it is possible if the certificate was created using REST API.Content of
MyCertPolicy_REST.json
somehow, REST API use different key names than the AZ CLIEnvironment Summary
Additional Context
The text was updated successfully, but these errors were encountered: