Add Certificate error in FinalizeOrder

[raysandeep]

Describe the bug
I'm using Azure DNS as my DNS provider. Facing the issue, when trying to add certificate.

To Reproduce
Steps to reproduce the behavior:

1. Dashboard
2. Add certificate
3. Error

Error

{
    "type": "https://tools.ietf.org/html/rfc9110#section-15.6.1",
    "title": "An error occurred while processing your request.",
    "status": 500,
    "detail": "Orchestrator function 'IssueCertificate' failed: The activity function 'FinalizeOrder' failed: \"Property  has invalid value\r\n\r\nStatus: 400 (Bad Request)\r\nErrorCode: BadParameter\r\n\r\nContent:\r\n{\"error\":{\"code\":\"BadParameter\",\"message\":\"Property  has invalid value\\r\\n\"}}\r\n\r\nHeaders:\r\nCache-Control: no-cache\r\nPragma: no-cache\r\nx-ms-keyvault-region: northeurope\r\nx-ms-client-request-id: a30f75d0-99c4-4abb-a583-1636e5f5c788\r\nx-ms-request-id: d602421c-a8b5-4e0a-8d9b-52ab5e3352f5\r\nx-ms-keyvault-service-version: 1.9.1988.1\r\nx-ms-keyvault-network-info: conn_type=Ipv4;addr=20.105.82.154;act_addr_fam=InterNetwork;\r\nX-Content-Type-Options: REDACTED\r\nStrict-Transport-Security: REDACTED\r\nDate: Thu, 02 Jan 2025 10:39:56 GMT\r\nContent-Type: application/json; charset=utf-8\r\nExpires: -1\r\nContent-Length: 77\r\n\". See the function execution logs for additional details.",
    "traceId": "00-f4f1e9078c7fbce38d3ec7910972b4cf-5a506872f532b008-00"
}

2025-01-02T10:32:18Z   [Error]   Executed 'FinalizeOrder' (Failed, Id=3d2cd018-61f2-4be8-99f8-98219f079b13, Duration=370ms)
2025-01-02T10:32:18Z   [Error]   f36f887239a84ba2addbb0f0ea7605d3: Function 'FinalizeOrder (Activity)' failed with an error. Reason: Azure.RequestFailedException
   at Azure.Security.KeyVault.KeyVaultPipeline.SendRequestAsync(Request request, CancellationToken cancellationToken)
   at Azure.Security.KeyVault.KeyVaultPipeline.SendRequestAsync[TContent,TResult](RequestMethod method, TContent content, Func`1 resultFactory, CancellationToken cancellationToken, String[] path)
   at Azure.Security.KeyVault.Certificates.CertificateClient.StartCreateCertificateAsync(String certificateName, CertificatePolicy policy, Nullable`1 enabled, IDictionary`2 tags, CancellationToken cancellationToken)
   at KeyVault.Acmebot.Functions.SharedActivity.FinalizeOrder(ValueTuple`2 input) in /home/runner/work/keyvault-acmebot/keyvault-acmebot/KeyVault.Acmebot/Functions/SharedActivity.cs:line 390
   at Microsoft.Azure.WebJobs.Host.Executors.FunctionInvoker`2.InvokeAsync(Object instance, Object[] arguments) in D:\a\_work\1\s\src\Microsoft.Azure.WebJobs.Host\Executors\FunctionInvoker.cs:line 53
   at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.InvokeWithTimeoutAsync(IFunctionInvoker invoker, ParameterHelper parameterHelper, CancellationTokenSource timeoutTokenSource, CancellationTokenSource functionCancellationTokenSource, Boolean throwOnTimeout, TimeSpan timerInterval, IFunctionInstance instance) in D:\a\_work\1\s\src\Microsoft.Azure.WebJobs.Host\Executors\FunctionExecutor.cs:line 581
   at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithWatchersAsync(IFunctionInstanceEx instance, ParameterHelper parameterHelper, ILogger logger, CancellationTokenSource functionCancellationTokenSource) in D:\a\_work\1\s\src\Microsoft.Azure.WebJobs.Host\Executors\FunctionExecutor.cs:line 523
   at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithLoggingAsync(IFunctionInstanceEx instance, FunctionStartedMessage message, FunctionInstanceLogEntry instanceLogEntry, ParameterHelper parameterHelper, ILogger logger, CancellationToken cancellationToken) in D:\a\_work\1\s\src\Microsoft.Azure.WebJobs.Host\Executors\FunctionExecutor.cs:line 306. IsReplay: False. State: Failed. RuntimeStatus: Failed. HubName: funclititcertbotn4n4. AppName: func-lititcertbot-n4n4. SlotName: Production. ExtensionVersion: 3.0.2. SequenceNumber: 101. TaskEventId: 2
2025-01-02T10:32:18Z   [Error]   f36f887239a84ba2addbb0f0ea7605d3: Function 'IssueCertificate (Orchestrator)' failed with an error. Reason: Microsoft.Azure.WebJobs.Extensions.DurableTask.FunctionFailedException
   at Microsoft.Azure.WebJobs.Extensions.DurableTask.DurableOrchestrationContext.CallDurableTaskFunctionAsync[TResult](String functionName, FunctionType functionType, Boolean oneWay, String instanceId, String operation, RetryOptions retryOptions, Object input, Nullable`1 scheduledTimeUtc) in /_/src/WebJobs.Extensions.DurableTask/ContextImplementations/DurableOrchestrationContext.cs:line 751
   at KeyVault.Acmebot.Functions.SharedOrchestrator.IssueCertificate(IDurableOrchestrationContext context) in /home/runner/work/keyvault-acmebot/keyvault-acmebot/KeyVault.Acmebot/Functions/SharedOrchestrator.cs:line 51
   at Microsoft.Azure.WebJobs.Host.Executors.VoidTaskMethodInvoker`2.InvokeAsync(TReflected instance, Object[] arguments) in D:\a\_work\1\s\src\Microsoft.Azure.WebJobs.Host\Executors\VoidTaskMethodInvoker.cs:line 20
   at Microsoft.Azure.WebJobs.Host.Executors.FunctionInvoker`2.InvokeAsync(Object instance, Object[] arguments) in D:\a\_work\1\s\src\Microsoft.Azure.WebJobs.Host\Executors\FunctionInvoker.cs:line 53
   at Microsoft.Azure.WebJobs.Extensions.DurableTask.TaskOrchestrationShim.InvokeUserCodeAndHandleResults(RegisteredFunctionInfo orchestratorInfo, OrchestrationContext innerContext) in /_/src/WebJobs.Extensions.DurableTask/Listener/TaskOrchestrationShim.cs:line 148. IsReplay: False. State: Failed. RuntimeStatus: Failed. HubName: funclititcertbotn4n4. AppName: func-lititcertbot-n4n4. SlotName: Production. ExtensionVersion: 3.0.2. SequenceNumber: 102. TaskEventId: -1
2025-01-02T10:32:18Z   [Error]   Executed 'IssueCertificate' (Failed, Id=e12bb104-0f2d-46a4-8279-d03b9ce0c4af, Duration=3ms)

Environment (please complete the following information):

• Certificate Type: Wildcard
• Certificate Deploy Target: App Service

Additional context
Add any other context about the problem here.

[Pierre-Malherbe]

Hello @raysandeep

We have the same issue here, and a fix is to downgrade the function

WEBSITE_RUN_FROM_PACKAGE : https://stacmebotprod.blob.core.windows.net/keyvault-acmebot/v4/4.1.8.zip

[raysandeep]

Worked! Thanks a ton!

[andysbolton]

I also had this issue, and downgrading from 4.2.0 to 4.1.13 fixed it (I'm using letsencrypt). Should this issue stay open, as it appears to have been introduced in 4.2.0? Is some infrastructure update necessary when using 4.2.0?

[shibayan]

This seems to be a bug with the corresponding cname. Perhaps the error is due to an empty tag value.

Fixes will be made quickly.

[shibayan]

This issue has been fixed in the recently released v4.2.1. Thank you for reporting it.

[janegilring]

@shibayan We hit the same issue even when running version v4.2.1. Did anyone get it working with this version?

[shibayan]

@janegilring I tried issuing a new certificate with the latest version, but no errors occurred and I was unable to reproduce the problem. Further investigation will require detailed error logs.

[janegilring]

@shibayan Thanks for checking. After filing the issue we noticed the certificate requests was blocked by a newly implemented Azure Policy which enforced restrictions on certificate lifetime. We will report back should the issue continue after re-upgrading to the latest version, but I think we found the root cause.