<p>I've a certificate (pfx) in my Azure KeyVault - I use that certificate as a secret (deployed via Azure DevOps using Helm). The problem I've encountered is that the certificate is somehow incorrectly read from KeyVault (I use Variable Group) - the result is that when my application starts, I get an exception that looks like: </p>

<pre><code>error:23076071:PKCS12 routines:PKCS12_parse:mac verify failure
</code></pre>

<p>However, when I manually create a secret (by using powershell to read certificate content as base64) everything works correctly. 
What am I doing incorrectly ?</p>

<p>Currently, Azure Pipelines variable group integration supports mapping only secrets from the Azure key vault. Cryptographic keys and certificates are not supported. See <a href="https://learn.microsoft.com/en-us/azure/devops/pipelines/library/variable-groups?view=azure-devops&amp;tabs=yaml#secrets-management-notes" rel="nofollow noreferrer">here</a>.</p>
<p>As workaround, you can use <a href="https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/deploy/azure-key-vault?view=azure-devops" rel="nofollow noreferrer">Azure Key Vault task</a> in your azure devops pipeline.</p>
<blockquote>
<p>Use this task to download secrets such as authentication keys, storage account keys, data encryption keys, .PFX files, and passwords from an Azure Key Vault instance.</p>
<p>If the value fetched from the vault is a certificate (for example, a PFX file), the task variable will contain the contents of the PFX in string format.</p>
</blockquote>
<pre><code>- task: AzureKeyVault@1
  inputs:
    azureSubscription: 
    keyVaultName: 
    secretsFilter: '*'
</code></pre>
<p>Before using this task. You should ensure the service principal you used in the Azure service connection has at least Get and List permissions on the vault.</p>
<p>This tutorial <a href="https://azuredevopslabs.com/labs/vstsextend/azurekeyvault/" rel="nofollow noreferrer">Using secrets from Azure Key Vault in a pipeline</a> might also be helpful.</p>
