cannot deserialize the current JSON Object

[modemgeek]

Our renewals have been failing. Checking the logs we see the following. We are running the latest version of the extension. We haven't made any changes to the webapp either.

Microsoft.Azure.WebJobs.Host.FunctionInvocationException: Microsoft.Azure.WebJobs.Host.FunctionInvocationException: Exception while executing function: Functions.RenewCertificate ---> Newtonsoft.Json.JsonSerializationException: Cannot deserialize the current JSON object (e.g. {"name":"value"}) into type 'Microsoft.Azure.Management.WebSites.Models.Certificate[]' because the type requires a JSON array (e.g. [1,2,3]) to deserialize correctly.
To fix this error either change the JSON to a JSON array (e.g. [1,2,3]) or change the deserialized type so that it is a normal .NET type (e.g. not a primitive type like integer, not a collection type like an array or List) that can be deserialized from a JSON object. JsonObjectAttribute can also be added to the type to force it to deserialize from a JSON object.
Path 'value', line 1, position 9.
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateObject(JsonReader reader, Type objectType, JsonContract contract, JsonProperty member, JsonContainerContract containerContract, JsonProperty containerMember, Object existingValue)
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateValueInternal(JsonReader reader, Type objectType, JsonContract contract, JsonProperty member, JsonContainerContract containerContract, JsonProperty containerMember, Object existingValue)
at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.Deserialize(JsonReader reader, Type objectType, Boolean checkAdditionalContent)
at Newtonsoft.Json.JsonSerializer.DeserializeInternal(JsonReader reader, Type objectType)
at Newtonsoft.Json.JsonConvert.DeserializeObject(String value, Type type, JsonSerializerSettings settings)
at Newtonsoft.Json.JsonConvert.DeserializeObject[T](String value, JsonSerializerSettings settings)
at LetsEncrypt.Azure.Core.CertificateManager.d__10.MoveNext() in c:\projects\letsencrypt-siteextension\LetsEncrypt.SiteExtension.Core\CertificateManager.cs:line 123
--- End of stack trace from previous location where exception was thrown ---

[sjkp]

hi @modemgeek thanks for repporting this, sounds like something was was changed in the ARM api I will investigate tonight if it's a general problem.

[modemgeek]

I also have a case open with Microsoft so i'll keep you updated. One thing I did notice in the Azure portal is that all the private certificates are no longer showing up in the list.

[sjkp]

This is interesting, just tried to force a web job renewal through on one of my own sites. It doesn't fail. Can you provide some more info, e.g. which region are you in. I suspect that they might have released a new version of the ARM API that is broken. Also which service plan you use, and if service plan and web app are in the same resource group

[modemgeek]

This is interesting, just tried to force a web job renewal through on one of my own sites. It doesn't fail. Can you provide some more info, e.g. which region are you in. I suspect that they might have released a new version of the ARM API that is broken. Also which service plan you use, and if service plan and web app are in the same resource group

This is happening to us in all the US regions. We are using both S2 and S3 ASP. The Webapp and ASP are in the same resource group. They used to be in different resource groups, but we moved them years ago to be in the same resource group.

[modemgeek]

also if I go to add a new ssl binding from the azure portal, the list of certificates to choose from is empty. At the minimum the certificates that are already bound should show up in the list. After I select the hostname, the private certificate list is empty.

[modemgeek]

so finished troubleshooting with microsoft. they said one of the api can return two different types of data. For some reason one of the ways isn't working for us.

});
this.privateCertificatesCache = new MsPortalFx.Data.QueryCache({
entityTypeName: Constants.EntityType.PrivateCertificate,
sourceUri: function (params) {
return "{0}/subscriptions/{1}/providers/Microsoft.Web/certificates?$filter=ServerFarmId eq '{2}'&api-version={3}".format(Utility_Urls_1.getCSMManagementEndpoint(), params.subscriptionId, params.serverFarmId, Constants.Asset.AntaresApiVersion);
},
setAuthorizationHeader: true,
processServerResponse: function (response) {
var mappedCertificates = response.map(function (cert) {
var keyVaultHealthStatus = Constants.KeyVaultHealthStatus.NA;
var properties = cert.properties;
if (properties.keyVaultSecretStatus) {

doing a browser debug he made me change the bold line to
});
this.privateCertificatesCache = new MsPortalFx.Data.QueryCache({
entityTypeName: Constants.EntityType.PrivateCertificate,
sourceUri: function (params) {
return "{0}/subscriptions/{1}/providers/Microsoft.Web/certificates?$filter=ServerFarmId eq '{2}'&api-version={3}".format(Utility_Urls_1.getCSMManagementEndpoint(), params.subscriptionId, params.serverFarmId, Constants.Asset.AntaresApiVersion);
},
setAuthorizationHeader: true,
processServerResponse: function (response) {
var mappedCertificates = response.value.map(function (cert) {
var keyVaultHealthStatus = Constants.KeyVaultHealthStatus.NA;
var properties = cert.properties;
if (properties.keyVaultSecretStatus) {

This would make the certificates appear. The error we get the the extension mentions the same VALUE. He said the code used for LE extension should be able to accept either type of response. I'm not a developer so can't really tell you what that means.

Let me know if what I said makes sense or not.

[modemgeek]

here's the explanation from the MS product group

The API

/certificate was returning an array as a response.

Looks like the ARM team did a change and now it is being wrapped in an wrapper object making it

{
“value”: []
}

So people who were expecting the list of certificates needs to get the list from the value object in the response rather than using the response directly.
I will give you an RCA on why this change was done with our knowing.

On your end check if response.value is present. If it is then use it. If not check if response has an array and use that as a fall back.

[sjkp]

What is that BS, their API is versioned, so why do they make a breaking change in an old version of the API.

[sjkp]

@modemgeek do you have a name on the person from the product team you talked to. I'm fixing the extension, but would like to yell at them, I don't consider changes like this acceptable to a public versioned api. You can email me mail@sjkp.dk - if you don't want to call them out in public ;)

[sjkp]

Try the new version and see if it fixes it. I cannot reproduce the error, so I can't really test it.