<p>I am trying to create a k8s tls secret (data and key) using a pfx certificate that I would like to retrieve from Azure key vault using Azure CLI. It doesn't work because Azure downloads the public part(certificate) and the secret part(key) separately and then creating the k8s secret fails. Here's my script.</p>
<pre><code>cert_key=cert.key
cert_pem=cert.pem
cert_pfx=cert.pfx
keyvault_name=akv_name
cert_name=akv_cert_name
secret_name=cert_pw_secret

#Get the password of the pfx certificate
secret_value=$(az keyvault secret show --name $secret_name --vault-name $keyvault_name  -o tsv --query value)

#Download the secret
az keyvault secret download --file $cert_key --name $cert_name --vault-name $keyvault_name

#Download the public part of the certificate
az keyvault certificate download --file $cert_pfx --name $cert_name --vault-name $keyvault_name

#Convert pfx to pem using openssl
#This will return an error:
#139728379422608:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1239:
#139728379422608:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:405:Type=PKCS12

openssl pkcs12 -in $cert_pfx  -clcerts -nokeys -out $cert_pem -password pass:$secret_value


#Convert pfx to key using openssl
#This will return an error:
#140546015532944:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:1239:
#140546015532944:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:405:Type=PKCS12

openssl  pkcs12 -in $cert_pfx -nocerts -out $cert_key -password pass:$secret_value

#Create the k8s secret
kubectl create secret tls secret-ssl --cert=$cert_pem --key=$cert_key
</code></pre>
<p>Any idea why it's not working?</p>
<p>Thanks in advance</p>

mangawy
<p><em><strong>I tried to reproduce the issue in my environment and got the below results</strong></em></p>
<p><em><strong>I have created the RG &amp; KV and secrets</strong></em></p>
<pre><code>az keyvault create -n kv_name -g RG_name
az keyvault secret set --vault-name kv_name --name secret_name --value &quot;value&quot;
</code></pre>
<p><img src="https://i.stack.imgur.com/LG8lx.png" alt="enter image description here" /></p>
<p><em><strong>I have added the polices to access the secrets</strong></em></p>
<p><em><strong>We can find the SPN id in active directory by creating with keyvault</strong></em></p>
<p><img src="https://i.stack.imgur.com/F2wnp.png" alt="enter image description here" /></p>
<pre><code>az keyvault set-policy -n &lt;kv-name&gt; --spn &lt;spn-id&gt; --secret-permissions get 
</code></pre>
<p><img src="https://i.stack.imgur.com/GXFGR.png" alt="enter image description here" /></p>
<p><em><strong>Added the certificate using below command</strong></em></p>
<pre><code>az keyvault certificate create --vault-name &lt;kv-name&gt; --name &lt;cert-name&gt; -p &quot;$(az keyvault certificate get-default-policy -o json)&quot;
</code></pre>
<p><em><strong>I have added the polices to access the certificates</strong></em></p>
<pre><code>az keyvault set-policy -n &lt;kv-name&gt; --spn &lt;spn-id&gt; --certificate-permissions get
</code></pre>
<p><em><strong>I have generated the private key using below command</strong></em></p>
<p><code>openssl genrsa 2048 &gt; private-key.key</code></p>
<p><img src="https://i.stack.imgur.com/go2gN.png" alt="enter image description here" /></p>
<p><em><strong>Generated the certificate and i have converted the file into .pfx</strong></em></p>
<pre><code>openssl req -new -x509 -nodes -sha256 -days 365 -key private-key.key -out certificate.cert
</code></pre>
<p><img src="https://i.stack.imgur.com/1VEY4.png" alt="enter image description here" /></p>
<pre><code>openssl pkcs12 -export -out certificate.pfx -inkey private-key.key -in certificate.cert
</code></pre>
<p><img src="https://i.stack.imgur.com/MVzLI.png" alt="enter image description here" /></p>
<p><em><strong>Encoded string and store it as a secret in Azure Key Vault. I have used the PowerShell commands to convert the <code>.pxf</code> file.</strong></em></p>
<pre><code>$fileContentBytes = get-content ‘certificate.pfx' -AsByteStream
[System.Convert]::ToBase64String($fileContentBytes) | Out-File ‘pfx-encoded-bytes.pem
</code></pre>
<p><img src="https://i.stack.imgur.com/Z1Sfj.png" alt="enter image description here" /></p>
<p><em><strong>The secret needs to have the content type set to &quot;application/x-pkcs12&quot; to tell Azure Key Vault that it is in PKCS file format.</strong></em></p>
<pre><code>az keyvault secret set --vault-name &lt;kv-name&gt; --name &lt;secret-name&gt; --file pfx-encoded-bytes.pem --description &quot;application/x-pkcs12&quot;
</code></pre>
<p><img src="https://i.stack.imgur.com/h8fUF.png" alt="enter image description here" /></p>
<p><em><strong>Downloaded the certificate using below command</strong></em></p>
<pre><code>az keyvault certificate download --file certificate1.pem --name my-certificate --vault-name komali-test
</code></pre>
<p><em><strong>Converted the pfx to pem using openssl</strong></em></p>
<pre><code>openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out certificate.pem -password pass:123
</code></pre>
<p><img src="https://i.stack.imgur.com/AU4Cz.png" alt="enter image description here" /></p>
<p><em><strong>I have converted .pfx to key using openssl</strong></em></p>
<pre><code>openssl  pkcs12 -in certtificate.pfx -nocerts -out private-key.key -password pass:XXXX
</code></pre>
<p><img src="https://i.stack.imgur.com/u7pqH.png" alt="enter image description here" /></p>
