Set-AzKeyVaultCertificatePolicy for setting -CertificateTransparency explicitly to $True throws BadRequest

[shimedh]

Description

Getting error - Set-AzKeyVaultCertificatePolicy: Operation returned an invalid status code 'BadRequest'

Steps to reproduce

Run the command - Set-AzureKeyVaultCertificatePolicy -VaultName "" -Name "" -CertificateTransparency $True

Module versions

Debug output

Error output

Set-AzKeyVaultCertificatePolicy: Operation returned an invalid status code 'BadRequest'

[dingmeng-xue]

@shimedh , please share us debug message via $DebugPreference="Continue"?

[shimedh]

$DebugPreference="Continue"

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
PATCH

Absolute Uri:
https://.vault.azure.net//certificates//policy?api-version=7.0

Headers:
x-ms-client-request-id : d7321ff9-7854-4281-9e97-6b95785830ee
Accept-Language : en-US

Body:
{
"key_props": {
"kty": "RSA",
"key_size": 2048
},
"issuer": {
"cert_transparency": true
},
"attributes": {
"enabled": true
}
}

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
BadRequest

Headers:
Cache-Control : no-cache
Pragma : no-cache
x-ms-keyvault-region : northcentralus
x-ms-request-id : 0c352841-b2fa-46a6-9231-4c93ed8a0b0e
x-ms-keyvault-service-version : 1.1.31.4
x-ms-keyvault-network-info : conn_type=Ipv4;addr=52.171.215.158;act_addr_fam=InterNetwork;
X-AspNet-Version : 4.0.30319
X-Powered-By : ASP.NET
Strict-Transport-Security : max-age=31536000;includeSubDomains
X-Content-Type-Options : nosniff
Date : Thu, 13 Aug 2020 05:15:28 GMT

Body:
{
"error": {
"code": "BadParameter",
"message": "Property issuer has invalid value\r\n"
}
}

DEBUG: AzureQoSEvent: CommandName - Set-AzKeyVaultCertificatePolicy; IsSuccess - False; Duration - 00:00:00.2929750;; Exception - Microsoft.Azure.KeyVault.Models.KeyVaultErrorException: Operation returned an invalid status code 'BadRequest'
at Microsoft.Azure.Commands.KeyVault.Models.KeyVaultDataServiceClient.UpdateCertificatePolicy(String vaultName, String certificateName, CertificatePolicy certificatePolicy)
at Microsoft.Azure.Commands.KeyVault.SetAzureKeyVaultCertificatePolicy.ExecuteCmdlet()
at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.<>c__31.<ExecuteSynchronouslyOrAsJob>b__3_0(T c) at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.ExecuteSynchronouslyOrAsJob[T](T cmdlet, Action1 executor)
at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.ExecuteSynchronouslyOrAsJob[T](T cmdlet)
at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord();
DEBUG: Finish sending metric.
DEBUG: 5:15:30 AM - SetAzureKeyVaultCertificatePolicy end processing.

[isra-fel]

Hi @shimedh , when setting -CertificateTransparency you need to specify -IssuerName as well. For example

Set-AzKeyVaultCertificatePolicy -VaultName yemingkv -Name TestCert01 -CertificateTransparency $false -IssuerName "Self"

I've submitted a PR to update the docs.