Article for service creation principal has misleading guidance for --cert

[jikuja]

Type of issue

Other (describe below)

Feedback

When you use a PEM file, the CERTIFICATE must be appended to the PRIVATE KEY within the file. on linked page is wrong:

• The AZ CLI example after that sentence is clearly using only certificate
• Implementation for local --cert is assuming that only certificate is present on the input: https://github.com/Azure/azure-cli/blob/b976aa4280016c33f9fda00307ba24d6670f1624/src/azure-cli/azure/cli/command_modules/role/custom.py#L1521-L1528

---

TBH this might be even security issue if MS Graph API logs contents of the keyCredential.key and documentation suggests sening private key into API.

Page URL

https://learn.microsoft.com/en-us/cli/azure/azure-cli-sp-tutorial-3

Content source URL

https://github.com/MicrosoftDocs/azure-docs-cli/blob/main/docs-ref-conceptual/azure-cli-sp-tutorial-3.md

Author

@dbradish-microsoft

Document Id

0fbbbebc-427f-0df1-3bfa-447fbafab071

[TPavanBalaji]

@jikuja
Thanks for your feedback! We will investigate and update as appropriate.

[TPavanBalaji]

@jikuja
Thank you for bringing this to our attention.
I've delegated this to content author, who will review it and offer their insightful opinions.

[jiasli]

It is true that the document is incorrect. Private key is not needed for --cert.

The in-tool help also mentions this:

https://github.com/Azure/azure-cli/blob/c85d66c83f9d6411178524f70fa73912595bc48b/src/azure-cli/azure/cli/command_modules/role/_params.py#L205-L208

            c.argument('cert', arg_group='keyCredential', validator=validate_cert,
                       help='Certificate to use for credentials. When used with `--keyvault,`, indicates the name of the '
                            'cert to use or create. Otherwise, supply a PEM or DER formatted public certificate string. '
                            'Use `@{path}` to load from a file. Do not include private key info.')

However, even if you include private key in the value of --cert, it won't be used, as only the public certificate is dumpped:

https://github.com/Azure/azure-cli/blob/6bbf23a39da7d6029ae7acf0393f3c00289a90c9/src/azure-cli/azure/cli/command_modules/role/custom.py#L1523

def _get_public(x509):
    import OpenSSL.crypto
    pem = OpenSSL.crypto.dump_certificate(OpenSSL.crypto.FILETYPE_PEM, x509)

TBH this might be even security issue if MS Graph API logs contents of the keyCredential.key and documentation suggests sening private key into API.

So this cannot be a security issue.