Question

我正在使用ARM模板来部署可以正常运行的ILB ASE，但现在我尝试将自签名证书放在ILB ASE上作为该部署的一部分，并且它始终失败并显示错误The specified network password is not correct

我实际上是通过Terraform应用ARM模板的。我将证书和密码存储在Key Vault中。我使用下面的PowerShell行从Key Vault中提取证书，然后将其作为变量传递到Terraform中。这是Base64编码格式的证书：

$aseCertBase64 = (Get-AzureKeyVaultSecret -VaultName $kvName -Name $kvASECertName).SecretValueText

我首先尝试使用Terraform数据资源获取Cert密码，但是部署失败，并出现The specified network password is not correct错误。为了解决密码问题，我将明文密码直接放入ARM模板，然后重新运行部署。部署再次失败，出现相同的错误，所以现在我不确定它在寻找什么。

我通过使用PowerShell从Key Vault中提取证书和密码，转换了证书并将其成功导入到我的本地存储中，来验证密码是否正确。

以下是我正在使用的ARM模板：

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "ilbase_name": {
            "type": "string",
            "metadata": {
                "description": "The name of the ILBASE"
            }
        },
        "ilbase_domain_name": {
            "type": "string",
            "metadata": {
                "description": "The prviate domain name inside ILBASE"
            }
        },
        "ilbase_subnet_name": {
            "type": "string",
            "metadata": {
                "description": "The name of the subnet assigned to the ILBASE"
            }
        },
        "ilbase_rglocation": {
            "defaultValue": "East US",
            "type": "string",
            "metadata": {
                "description": "The region where the ILBASE will be deployed"
            }
        },
        "vnet_name": {
            "type": "string",
            "metadata": {
                "description": "The name of the vnet the ILBASE subnet is part of"
            }
        },
        "vnet_rg": {
            "type": "string",
            "metadata": {
                "description": "The name of the resource group the ILBASE vnet is in"
            }
        },
        "vnet_id": {
            "type": "string",
            "metadata": {
                "description": "The resource id of the ILBASE vnet"
            }
        },
        "aseCert": {
            "type": "string",
            "metadata": {
                "description": "The Base64 encoded string containing the cert to be applied to the ILBASE"
            }
        },
        "aseCertPwd": {
            "defaultValue": "XNKVTzCell637BNl",
            "type": "string",
            "metadata": {
                "description": "The password for the ILBASE certificate"
            }
        },
        "aseCertName": {
            "defaultValue": "aseCert",
            "type": "string",
            "metadata": {
                "description": "The password for the ILBASE certificate"
            }
        }
    },
    "resources": [
        {
            "apiVersion": "2015-08-01",
            "type": "Microsoft.Web/certificates",
            "name": "[parameters('aseCertName')]",
            "location": "[parameters('ilbase_rglocation')]",
            "properties": {
                "pfxBlob": "[parameters('aseCert')]",
                "password": "[parameters('aseCertPwd')]",
                "hostingEnvironmentProfile": {
                    "id": "[resourceId('Microsoft.Web/hostingEnvironments',parameters('ilbase_name'))]"
                }
            },
            "dependsOn": [
                "[concat('Microsoft.Web/hostingEnvironments/',parameters('ilbase_name'))]"
            ]
        },
        {
            "apiVersion": "2018-02-01",
            "type": "Microsoft.Web/hostingEnvironments",
            "name": "[parameters('ilbase_name')]",
            "kind": "ASEV2",
            "location": "[parameters('ilbase_rglocation')]",
            "properties": {
                "name": "[parameters('ilbase_name')]",
                "location": "[parameters('ilbase_rglocation')]",
                "vnetName": "[parameters('vnet_name')]",
                "vnetResourceGroup": "[parameters('vnet_rg')]",
                "vnetSubnetName": "[parameters('ilbase_subnet_name')]",
                "virtualNetwork": {
                    "Id": "[parameters('vnet_id')]",
                    "Subnet": "[parameters('ilbase_subnet_name')]"
                },
                "dnsSuffix": "[parameters('ilbase_domain_name')]",
                "internalLoadBalancingMode": "Web, Publishing",
                "multiSize": "Medium",
                "multiRoleCount": 2,
                "ipsslAddressCount": 0,
                "networkAccessControlList": [],
                "frontEndScaleFactor": 15,
                "suspended": false
            }
        }
    ]
}

Answer 1

考虑查看为证书调用thumbPrint参数。我认为这是基于默认ARM模板Microsoft have on GitHub here所必需的。在docs.microsoft.com处有更多参考。

通过ARM模板将证书应用于ASE ILB失败

1 个答案: