Applying cert to ASE ILB via ARM template fails - azure

Question

I am using an ARM template to deploy an ILB ASE which works fine but I am now trying to put a self-signed certificate on the ILB ASE as part of that deployment and it keeps failing with the error The specified network password is not correct.
I am actually applying the ARM template via Terraform. I store the certificate and the password in Key Vault. I pull the certificate from Key Vault using the PowerShell line below and then pass it into Terraform as a variable. This is the cert in Base64 encoded format:
$aseCertBase64 = (Get-AzureKeyVaultSecret -VaultName $kvName -Name $kvASECertName).SecretValueText
I first tried obtaining the Cert password using a Terraform data resource but that deployment failed with the The specified network password is not correct error. In an attempt to troubleshoot the password issue, I put the clear text password into the ARM template directly and re-ran the deployment. The deployment failed again with the same error so now I am not sure what it is looking for.
I validated that the password was correct by pulling the cert and password from Key Vault with PowerShell, converting the cert and then importing it into my local store successfully.
Below is the ARM Template I am using:
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"ilbase_name": {
"type": "string",
"metadata": {
"description": "The name of the ILBASE"
}
},
"ilbase_domain_name": {
"type": "string",
"metadata": {
"description": "The prviate domain name inside ILBASE"
}
},
"ilbase_subnet_name": {
"type": "string",
"metadata": {
"description": "The name of the subnet assigned to the ILBASE"
}
},
"ilbase_rglocation": {
"defaultValue": "East US",
"type": "string",
"metadata": {
"description": "The region where the ILBASE will be deployed"
}
},
"vnet_name": {
"type": "string",
"metadata": {
"description": "The name of the vnet the ILBASE subnet is part of"
}
},
"vnet_rg": {
"type": "string",
"metadata": {
"description": "The name of the resource group the ILBASE vnet is in"
}
},
"vnet_id": {
"type": "string",
"metadata": {
"description": "The resource id of the ILBASE vnet"
}
},
"aseCert": {
"type": "string",
"metadata": {
"description": "The Base64 encoded string containing the cert to be applied to the ILBASE"
}
},
"aseCertPwd": {
"defaultValue": "XNKVTzCell637BNl",
"type": "string",
"metadata": {
"description": "The password for the ILBASE certificate"
}
},
"aseCertName": {
"defaultValue": "aseCert",
"type": "string",
"metadata": {
"description": "The password for the ILBASE certificate"
}
}
},
"resources": [
{
"apiVersion": "2015-08-01",
"type": "Microsoft.Web/certificates",
"name": "[parameters('aseCertName')]",
"location": "[parameters('ilbase_rglocation')]",
"properties": {
"pfxBlob": "[parameters('aseCert')]",
"password": "[parameters('aseCertPwd')]",
"hostingEnvironmentProfile": {
"id": "[resourceId('Microsoft.Web/hostingEnvironments',parameters('ilbase_name'))]"
}
},
"dependsOn": [
"[concat('Microsoft.Web/hostingEnvironments/',parameters('ilbase_name'))]"
]
},
{
"apiVersion": "2018-02-01",
"type": "Microsoft.Web/hostingEnvironments",
"name": "[parameters('ilbase_name')]",
"kind": "ASEV2",
"location": "[parameters('ilbase_rglocation')]",
"properties": {
"name": "[parameters('ilbase_name')]",
"location": "[parameters('ilbase_rglocation')]",
"vnetName": "[parameters('vnet_name')]",
"vnetResourceGroup": "[parameters('vnet_rg')]",
"vnetSubnetName": "[parameters('ilbase_subnet_name')]",
"virtualNetwork": {
"Id": "[parameters('vnet_id')]",
"Subnet": "[parameters('ilbase_subnet_name')]"
},
"dnsSuffix": "[parameters('ilbase_domain_name')]",
"internalLoadBalancingMode": "Web, Publishing",
"multiSize": "Medium",
"multiRoleCount": 2,
"ipsslAddressCount": 0,
"networkAccessControlList": [],
"frontEndScaleFactor": 15,
"suspended": false
}
}
]
}

Answer 1

Consider looking at calling the thumbPrint parameter for the cert. I believe that's required based on the default ARM template Microsoft have on GitHub here. Some further reference here at learn.microsoft.com.