New-AzADApplication：密钥证书的结束日期无效。 PowerShell中的错误

Question

以下是我在Azure Cloud Shell中使用的powershell命令。

PS Azure:\> $keyCredential = New-Object -TypeName Microsoft.Azure.Commands.ActiveDirectory.PSADKeyCredential
Azure:/
PS Azure:\> $keyCredential.StartDate = [System.DateTime]::Now
Azure:/
PS Azure:\> $keyCredential.EndDate = [System.DateTime]::Now.AddYears(1)
Azure:/
PS Azure:\> $keyCredential.KeyId = $keyId
Azure:/
PS Azure:\> $keyCredential.CertValue = $certBase64
Azure:/
PS Azure:\> $adApp = New-AzADApplication -DisplayName "myorg-keyvault-monitor-ad-app" `
>>     -IdentifierUris "https://myorg.keyvault.com" `
>>     -HomePage "https://myorg.keyvault.com" `
>>     -KeyCredentials $keyCredential `
>>     -Verbose

我收到以下错误。 可能是什么问题？我尝试了本文Why am I getting "Key credential start date is invalid." trying to create a Active Directory Service Principal中提到的选项，但仍然遇到相同的错误。

VERBOSE: No value specified for -EndDate parameter; setting the value to one year after start date.
VERBOSE: Performing the operation "Adding a new application with display name 'myorg-keyvault-monitor-ad-app'" on target "myorg-keyvault-monitor-ad-app".
New-AzADApplication : Key credential end date is invalid.
At line:1 char:10
+ $adApp = New-AzADApplication -DisplayName "myorg-keyvault-monitor-ad- ...
+          ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : InvalidOperation: (:) [New-AzADApplication], Exception
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.ActiveDirectory.NewAzureADApplicationCommand

Answer 1

我可以重现您的问题，该问题是由您在X509证书有效日期之后设置了EndDate引起的，对于asymmetric类型的凭据，我们需要在有效之前设置它日期。

要解决此问题，请更改$keyCredential.EndDate，您可以参考我的完整示例。

$cer = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$cer.Import("C:\Users\joyw\Desktop\test123.cer")
$binCert = $cer.GetRawCertData()
$credValue = [System.Convert]::ToBase64String($binCert)

$keyCredential = New-Object -TypeName Microsoft.Azure.Commands.ActiveDirectory.PSADKeyCredential
$keyCredential.StartDate = [System.DateTime]::Now
$keyCredential.EndDate = $cer.NotAfter
$keyCredential.KeyId = "<guid>"
$keyCredential.CertValue = $credValue
$adApp = New-AzADApplication -DisplayName "testapp3" -IdentifierUris "https://myorg.keyvault.com" -HomePage "https://myorg.keyvault.com" -KeyCredentials $keyCredential -Verbose