title: Azure Key Vault: unable to get a cert from kv when deployed
body: <p>I have a webjob getting a certificate from azure key vault service and locally i have no problem accessing/retrieving this cert from kv. However, when this webjob gets deployed, I get this error:</p>
  
  <pre><code>System.Security.Cryptography.CryptographicException: The system cannot find the file specified.
  
     at System.Security.Cryptography.CryptographicException.ThrowCryptographicException(Int32 hr)
     at System.Security.Cryptography.X509Certificates.X509Utils._LoadCertFromBlob(Byte[] rawData, IntPtr password, UInt32 dwFlags, Boolean persistKeySet, SafeCertContextHandle&amp; pCertCtx)
     at System.Security.Cryptography.X509Certificates.X509Certificate.LoadCertificateFromBlob(Byte[] rawData, Object password, X509KeyStorageFlags keyStorageFlags)
     at Microsoft.Ambassadors.Infrastructure.KeyVaultService.&lt;GetCertificateAsync&gt;d__7.MoveNext() in C:\Source\Repos\Xbox.Ambassadors\Microsoft.Ambassadors.Azure\Microsoft.Ambassadors.Infrastructure\KeyVaultService.cs:line 0
  </code></pre>
  
  <p>I have registered the app (where this webjob is hosted) with AAD, and it has read only access to the kv space. I have found a couple of relevant (I think..?) posts regarding this:</p>
  
  <p><a href="https://stackoverflow.com/questions/1345262/an-internal-error-occurred-when-loading-pfx-file-with-x509certificate2">&quot;An internal error occurred.&quot; when loading pfx file with X509Certificate2</a></p>
  
  <p><a href="https://stackoverflow.com/questions/9951729/x509certificate-constructor-exception">X509Certificate Constructor Exception</a></p>
  
  <p>but I'm not really sure if this is something that I can do in my case...? If anyone can help, that would really be great! Thanks :D</p>