Azure api management ssl certificate must have a private key

Question

I have been working on the deployment of an azure api management with a self signed certificate and private key.

Goes without saying that I tested my terraform code a couple of days ago and everything worked just fine and I was able to deploy my infra using terraform, so I deleted the resources group from the portal. Today I wanted to spin up the infra once again but I got the following error:

Error: creating/updating API Management Service "demo-apim-testing" (Resource Group "rg-testing-apim"): apimanagement.ServiceClient#CreateOrUpdate: Failure sending request: StatusCode=0 -- Original Error: Code="InvalidParameters" Message="Invalid parameter: Certificate 'XXXXXXXX' must have a Private Key."

And the error points to this resource:

resource "azurerm_api_management" "demo-apim" {
  name     = "demo-apim-test"
  sku_name = "Developer_1"

  hostname_configuration {
    proxy {
      host_name                    = "apim.test.com"
      certificate                  = filebase64(var.ssl_certificate_path)
      certificate_password         = var.ssl_certificate_password
      default_ssl_binding          = true
      negotiate_client_certificate = false
    }
  }

I did generated the certificate .cer and the .pfx as set them as variables:

variable "ssl_certificate_path" {
  default = "./certificate.cer"
}

variable "pfx_certificate" {
  default = "./certificate.pfx"
  
}

variable "ssl_certificate_password" {
  default = "XXXXX"
}

while in my application gateway I set the same configuration. as follow:

  ssl_certificate {
    data     = filebase64(var.pfx_certificate)
    name     = "demo-app-gateway-certificate"
    password = var.ssl_certificate_password
    

  }

  trusted_root_certificate {
    data = filebase64(var.ssl_certificate_path)
    name = "demo-trusted-root-ca-certificate"
  }

This same configuration returned successful on my latest deployment and was able to test the connection and everything. But today it just does not recognise my certificate anymore.

Can please anyone enlighten me about what am I doing wrong here?

Please if you need more details or you have any question, don't hesitate to ask. thank you so much

Answer 1

As the certificate block supports the base 64 encoded PFX or base 64 encoded X.509 certificate,

You can use the below code:

certificate = filebase64(var.pfx_certificate)

Instead of

certificate = filebase64(var.ssl_certificate_path)

So the final code should like below:

resource "azurerm_api_management" "demo-apim" {
  name     = "demo-apim-test"
  sku_name = "Developer_1"

  hostname_configuration {
    proxy {
      host_name                    = "apim.test.com"
      certificate                  = filebase64(var.pfx_certificate))
      certificate_password         = var.ssl_certificate_password
      default_ssl_binding          = true
      negotiate_client_certificate = false
    }
  }