az keyvault certificate create - validation too strict

[Splaxi]

Windows 11

PS C:\>az version 
{
  "azure-cli": "2.61.0",
  "azure-cli-core": "2.61.0",
  "azure-cli-telemetry": "1.1.0",
  "extensions": {}
}

Describe the bug
Trying to create a new certificate, based on the input that I'm required from portal.azure.com or the Az.KeyVault PowerShell module. The validation is to strict in the following code:

azure-sdk-for-python/sdk/keyvault/azure-keyvault-certificates/azure/keyvault/certificates/_client.py

Lines 94 to 96 in a624a22

	if not (policy.san_emails or policy.san_user_principal_names or policy.san_dns_names or policy.subject):
	raise ValueError(NO_SAN_OR_SUBJECT)

To Reproduce
Policy - as json

{
    "policy": {
        "key_props": {
            "kty": "RSA",
            "key_size": 2048,
            "reuse_key": false
        },
        "secret_props": {
            "contentType": "application/x-pkcs12"
        },
        "x509_props": {
            "subject": "CN=testing.contoso.com",
            "validity_months": 12
        },
        "issuer": {
            "name": "Unknown"
        },
        "attributes": {
            "enabled": true
        }
    }
}

Az Cli command executed, in PowerShell 7+

az keyvault certificate create --vault-name this-is-keyvault --name this-is-a-cert --policy $policyJson

I'm confident that I have handled the quotation issues within powershell, as I'm able to post the above policy directly via:

az rest --resource https://vault.azure.net --method post --uri https://this-is-keyvault.vault.azure.net/certificates/this-is-a-cert/create?api-version=7.4 --body $policyJson

The error code / message posted:
You need to set either subject or one of the subject alternative names parameters in the policy

Expected behavior
I'm expecting it to create a valid, pending, certificate. Just like it would via the portal.azure.com, Az.KeyVault PowerShell module or the Azure REST API for KeyVault / Certificates

Screenshots

Additional context

[github-actions]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @jlichwa @RandalliLama @schaabs.

[mccoyp]

Hi @Splaxi -- thank you for opening an issue, and I apologize for the delayed response. I was able to reproduce your issue today and did some digging for the cause. Given that your example policy includes a subject, the error message made me think that the CLI may not be processing the policy as intended.

I found the build_certificate_policy method in the CLI's source code, which is where the policy parameter seems to actually be processed. I noticed that the anticipated format was a little different from your JSON; key_properties was expected instead of key_props, validity_in_months instead of validity_months, etc. I ended up setting the following $policyJson based on the CLI's expectations:

{
  "key_properties": {
    "key_type": "RSA",
    "key_size": 2048,
    "reuse_key": false
  },
  "secret_properties": {
    "content_type": "application/x-pkcs12"
  },
  "x509_certificate_properties": {
    "subject": "CN=testing.contoso.com",
    "validity_in_months": 12
  },
  "issuer_parameters": {
    "name": "Unknown"
  },
  "attributes": {
    "enabled": true
  }
}

With this $policyJson, the same az keyvault certificate create command now worked -- it seems that the issue was coming from the format.

I found an old issue about the unclear guidance on certificate policy formatting: Azure/azure-cli#9423. The az keyvault certificate get-default-policy --scaffold command does give a helpful guide for policy formatting -- the policy scaffold uses camelCase instead of snake_case, and I found that replacing the parameter casing of the policyJson above also works with the az keyvault certificate create command.

cc @evelyn-ys to forward CLI feedback.

[github-actions]

Hi @Splaxi. Thank you for opening this issue and giving us the opportunity to assist. We believe that this has been addressed. If you feel that further discussion is needed, please add a comment with the text "/unresolve" to remove the "issue-addressed" label and continue the conversation.

[github-actions]

Hi @Splaxi, since you haven’t asked that we /unresolve the issue, we’ll close this out. If you believe further discussion is needed, please add a comment /unresolve to reopen the issue.