az keyvault certificate create - validation too strict about azure-sdk-for-python

[github-actions]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @jlichwa @RandalliLama @schaabs.

[mccoyp]

Hi @Splaxi -- thank you for opening an issue, and I apologize for the delayed response. I was able to reproduce your issue today and did some digging for the cause. Given that your example policy includes a subject, the error message made me think that the CLI may not be processing the policy as intended.

I found the build_certificate_policy method in the CLI's source code, which is where the policy parameter seems to actually be processed. I noticed that the anticipated format was a little different from your JSON; key_properties was expected instead of key_props, validity_in_months instead of validity_months, etc. I ended up setting the following $policyJson based on the CLI's expectations:

{
  "key_properties": {
    "key_type": "RSA",
    "key_size": 2048,
    "reuse_key": false
  },
  "secret_properties": {
    "content_type": "application/x-pkcs12"
  },
  "x509_certificate_properties": {
    "subject": "CN=testing.contoso.com",
    "validity_in_months": 12
  },
  "issuer_parameters": {
    "name": "Unknown"
  },
  "attributes": {
    "enabled": true
  }
}

With this $policyJson, the same az keyvault certificate create command now worked -- it seems that the issue was coming from the format.

I found an old issue about the unclear guidance on certificate policy formatting: Azure/azure-cli#9423. The az keyvault certificate get-default-policy --scaffold command does give a helpful guide for policy formatting -- the policy scaffold uses camelCase instead of snake_case, and I found that replacing the parameter casing of the policyJson above also works with the az keyvault certificate create command.

cc @evelyn-ys to forward CLI feedback.

[github-actions]

Hi @Splaxi. Thank you for opening this issue and giving us the opportunity to assist. We believe that this has been addressed. If you feel that further discussion is needed, please add a comment with the text "/unresolve" to remove the "issue-addressed" label and continue the conversation.

[github-actions]

Hi @Splaxi, since you haven’t asked that we /unresolve the issue, we’ll close this out. If you believe further discussion is needed, please add a comment /unresolve to reopen the issue.