Generated certificate doesn't have intermediate and root certificates included

[McHammar]

When I generate a certificate and download it from the keyvault, it doesn't have the intermediate certificate or the root included.
I use the certificate inside NGINX so it needs the full chain.
From reading issues here it looks like it is supposed to include the intermediate but not for me.
Am I doing something wrong?

I solved it earlier by downloading the intermediate and root from Letsencrypt website and merge it with the certificate but now when they changed to R10 and R11 that doesn't work anymore.

[shibayan]

We have confirmed that intermediate certificates should be included, but there is a problem with the certificate files that can be downloaded from Key Vault, which are not listed in the correct order.

If you download it as a PFX file, you should be able to see that the intermediate certificate is included. We believe this is an unavoidable problem when issuing certificates using Key Vault.

[McHammar]

We download it in our CI/CD pipeline with az cli like below and then we can't select it as PFX.

The az cli script looks like this:

az keyvault certificate download \
    --vault-name <keyvault \
    --name "$cert" \
    --encoding pem \
    --file "$CERTDIR/temp.pem"

Seems like I need to change to az keyvault secret download like metioned here
Azure/azure-cli#7489

[McHammar]

Got the download of PFX working and the certificate does include key and both cert and intermediate.
However the key file for nginx says:
SSL: error:05800074:x509 certificate routines::key values mismatch)
Any idea why?

[webprofusion-chrisc]

When you download your PFX you then need to convert it into a full chain pem and a private key pem for nginx to use, the error just says your private key file does not match the certificate.

[McHammar]

I have converted it to both a pem with both certs and key included in the same file and also seperated out the key to its own file but still get key values mismatch

To get certs I run this:
openssl pkcs12 -in cert.pfx -out certs.pem -nodes -nokeys

And to get the key I run:
openssl pkcs12 -in cert.pfx -out certs.key -nodes -nocerts

The cert file looks like this:

Bag Attributes: <Empty Attributes>
subject=C = US, O = Let's Encrypt, CN = R10
issuer=C = US, O = Internet Security Research Group, CN = ISRG Root X1
-----BEGIN CERTIFICATE-----
MIIFBTCCA....
-----END CERTIFICATE-----
Bag Attributes
    localKeyID: 01 00 00 00
subject=CN = <removed>
issuer=C = US, O = Let's Encrypt, CN = R10
-----BEGIN CERTIFICATE-----
MIIFBzCCA++gAwI......
-----END CERTIFICATE-----

The key file like this:

Bag Attributes
    localKeyID: 01 00 00 00
    friendlyName: 3fdb80c7-a0cd-49eb-87c1-259c0a2ec0de
    Microsoft CSP Name: Microsoft Enhanced RSA and AES Cryptographic Provider
Key Attributes
    X509v3 Key Usage: 10
-----BEGIN PRIVATE KEY-----
<removed>
-----END PRIVATE KEY-----

[kayahk]

I had the same issue with the certificate for a container instance and ended up using an init container that just runs these crude commands in that order to write the files to a storage account. I guess that it should work within CICD as well:

az login --identity
az keyvault secret show --vault-name $KEY_VAULT_NAME --name $CERT_NAME --query value -o tsv | base64 --decode > /etc/vault/config/certificate.pfx
openssl pkcs12 -in /etc/vault/config/certificate.pfx -nokeys -cacerts -out /etc/vault/config/ca.pem -passin pass:
openssl pkcs12 -in /etc/vault/config/certificate.pfx -nokeys -clcerts -out /etc/vault/config/crt.pem -passin pass:
openssl pkcs12 -in /etc/vault/config/certificate.pfx -nocerts -nodes -out /etc/vault/config/key.pem -passin pass:
cat crt.pem ca.pem > cert.pem