Getting httpResponseMessage when trying to add Certificate to function app - azure

Question

I am deploying a function app via ARM template. I have added the following snippet to add the certificate from the Azure Key vault and the added a host name binding.
{
"type": "Microsoft.Web/certificates",
"apiVersion": "2019-08-01",
"name": "[parameters('certificateName')]",
"location": "North Europe",
"dependsOn": [
"[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]"
],
"properties": {
"keyVaultId": "[resourceId(parameters('keyvaultRG'), 'Microsoft.KeyVault/vaults', parameters('keyvaultName'))]",
"keyVaultSecretName": "[parameters('existingKeyVaultSecretName')]",
"serverFarmId": "[resourceId('Microsoft.Web/serverFarms', parameters('hostingPlanName'))]"
}
},
{
"type": "Microsoft.Web/sites/hostnameBindings",
"name": "[concat(parameters('functionAppName'), '/', parameters('customDomainName'))]",
"apiVersion": "2019-08-01",
"location": "North Europe",
"dependsOn": [
"[resourceId('Microsoft.Web/certificates', parameters('certificateName'))]"
],
"properties": {
"sslState": "SniEnabled",
"thumbprint": "[reference(resourceId('Microsoft.Web/certificates', parameters('certificateName'))).Thumbprint]"
}
}
But when I don deploy the ARM template I get the following error at Microsoft.Web/certificates
"message": "The parameter httpResponseMessage has an invalid value."

Answer 1

Please check if the below steps help to fix the issue:
error at Microsoft.Web/certificates "message": "The parameter {0} has an invalid value."
Follow the below steps to fix this issue:
Enable the Microsoft.Web resource provider to direct access the Azure Key Vault using the Azure PowerShell.
Login-AzureRmAccount
Set-AzureRmContext -SubscriptionId AZURE_SUBSCRIPTION_ID
Set-AzureRmKeyVaultAccessPolicy -VaultName KEY_VAULT_NAME -ServicePrincipalName <ServicePrincipalId> -PermissionsToSecrets get
Check the Access Policies of Azure Key Vault: Azure Key Vault > Access Policies > Add New (Microsft.Web) Your-Function-App
Azure PowerShell Commands for inserting the certificate to the KeyVault:
$pfxFilePath = "PFX_CERTIFICATE_FILE_PATH" # Change this path
$pwd = "PFX_CERTIFICATE_PASSWORD" # Change this password
$flag = [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable
$collection = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection
$collection.Import($pfxFilePath, $pwd, $flag)
$pkcs12ContentType = [System.Security.Cryptography.X509Certificates.X509ContentType]::Pkcs12
$clearBytes = $collection.Export($pkcs12ContentType)
$fileContentEncoded = [System.Convert]::ToBase64String($clearBytes)
$secret = ConvertTo-SecureString -String $fileContentEncoded -AsPlainText –Force
$secretContentType = 'application/x-pkcs12'
Set-AzureKeyVaultSecret -VaultName KEY_VAULT_NAME -Name KEY_VAULT_SECRET_NAME -SecretValue $Secret -ContentType $secretContentType # Change Name of Azure KV & Secret
Next step is using the KeyVaultSecretName for directly accessing the KeyVault in order to get the value.
WebSite.parameters:
{
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/deploymentParameters.json",
"contentVersion": "1.0.0.0",
"parameters": {
"functionAppName": {
"value": "yourfunctionappname"
},
"customHostname": {
"value": "yourcustomdomianname"
},
"existingKeyVaultId": {
"value": "/subscriptions/subscriptionsID/resourceGroups/resourceGroupsName/providers/Microsoft.KeyVault/vaults/vaultsName"
},
"existingKeyVaultSecretName": {
"value": "The key vaults SecretName"
}
}
}