Error: unable to build authorizer for Resource Manager API: could not configure ClientCertificate Authorizer: could not decode PKCS#12 archive: pkcs12: decryption password incorrect

[andrewtatham-shell]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.8.0

AzureRM Provider Version

3.100.0

Affected Resource(s)/Data Source(s)

azurerm

Terraform Configuration Files

Can't share the config right now. This was working fine with our old certificate. We have been given a new certificate, generated with the following options...

Request Body for API call to Azure Key Vault to generate certificate:
{
  "policy": {
    "issuer": {
      "name": "Self"
    },
    "key_props": {
      "exportable": true,
      "key_size": 2048,
      "kty": "RSA",
      "reuse_key": false
    },
    "secret_props": {
      "contentType": "application/x-pkcs12"
    },
    "x509_props": {
      "subject": "CN=@{body('Parse_(DB_App)_JSON')?['SPNName']}"
    }
  }
}

Previous issues have required that the certificate is converted from PFX to PEM to PFX for compatibility with terraform. The following powershell script completes successfully, surely proving that the password actually is correct.

$originalPfx = "mycert_orig.pfx"
$pem = "mycert.pem"
$finalPfx = "mycert.pfx"

$password = "mypassword1234"
$securePassword = ConvertTo-SecureString -String $password -AsPlainText -Force

# display PFX info (optional) (blank password)
openssl pkcs12 -info -in $originalPfx -nodes -passin pass:

# Export PFX to PEM (blank password)
openssl pkcs12 -nodes -in $originalPfx -out $pem -passin pass:

# display PEM info (optional) (no password)
openssl x509 -in $pem 

# Export PEM to PFX (with password)
openssl pkcs12 -nodes -export -out $finalPfx -in $pem -passout pass:$password

# display PFX info (optional) (with password)
openssl pkcs12 -info -in $finalPfx -nodes -passin pass:$password

# Register the certificate (with secure password)
Import-PfxCertificate -FilePath $finalPfx -CertStoreLocation Cert:\localMachine\my -Password $securePassword

# Test the PFX (ps)
$Thumbprint = 'my thumbprint'
$TenantId = 'my tenant'
$ApplicationId = 'my app id'
Connect-AzAccount -CertificateThumbprint $Thumbprint -ApplicationId $ApplicationId -Tenant $TenantId -ServicePrincipal

# Test the PEM (az)
$AppUrl = 'http://myspn' 
az login --service-principal --tenant $TenantId -u $AppUrl -p $pem 
az account subscription list

The same result is given if either the original pfx is used, or the final pfx is used.

### Debug Output/Panic Output

```shell
│ Error: unable to build authorizer for Resource Manager API: could not configure ClientCertificate Authorizer: could not decode PKCS#12 archive: pkcs12: decryption password incorrect   
│
│   with provider["registry.terraform.io/hashicorp/azurerm"],
│   on main.tf line 33, in provider "azurerm":
│   33: provider "azurerm" {
│
╵

Expected Behaviour

Plan completes successfully with no errors

Actual Behaviour

The plan seems to complete successfully, then logs the error

<usual planning stuff>

 Plan: 3 to add, 0 to change, 0 to destroy.

│ Error: unable to build authorizer for Resource Manager API: could not configure ClientCertificate Authorizer: could not decode PKCS#12 archive: pkcs12: decryption password incorrect   
│
│   with provider["registry.terraform.io/hashicorp/azurerm"],
│   on main.tf line 33, in provider "azurerm":
│   33: provider "azurerm" {
│

Steps to Reproduce

terraform plan

Important Factoids

No response

References

It is similar to this issue but with a different error: #16228

And the solution linked to in that issue has not helped: https://discuss.hashicorp.com/t/azure-service-principal-client-certificate-error/32037?msclkid=9351d13bd12411ec96deb763dd60b7af

The options (-certpbe PBE-SHA1-3DES -keypbe PBE-SHA1-3DES -legacy ) listed here have not helped: external-secrets/external-secrets#2281

I see this issue about PKCS12 handling: #19374

[andrewtatham-shell]

I have found the place where the password was wrong. Please accept my humble apologies for wasting your time!