Terraform Azure Provider: Authenticating using a Service Principal with a Client Certificate

Question

I am trying to run terraform using Azure Service Principal, I am trying to do this with certificate, now I have pfx file and it's password, I converted this in pem and logged in via command line to test if cert is working which is the case, now when I try to run terraform with pfx I get the following errors

Error building ARM Config: 1 error occurred: │ * the Client Certificate Path is not a valid pfx file: pkcs12: unknown digest algorithm: 2.16.840.1.101.3.4.2.1

or

Error building ARM Config: 1 error occurred: │ * the Client Certificate Path is not a valid pfx file: pkcs12: expected exactly two safe bags in the PFX PDU

this is my providers.tf

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "3.75.0"
    }
    null = {
      source = "hashicorp/null"
    }
  }
  backend "azurerm" {
    resource_group_name  = "xxxxxxxx"
    storage_account_name = "xxxxxxxxx"
    container_name       = "tfstate"
    key                  = "terraform.tfstate"
    client_id                   = "xxxxxxxxxxxxxxxxxxxxxxxxxx"
    tenant_id                   = "xxxxxxxxxxxxxxxxxxx"
    client_certificate_path     = "/cert.pfx"
    client_certificate_password = "xxxxxxxxxxxxxxxx"
    subscription_id             = "xxxxxxxxxxxxxxxxxx"
  }
}

provider "azurerm" {
  features {}

  skip_provider_registration = true
}```

Answer 1

Terraform Authenticating using a Service Principal with a Client Certificate

The errors encountered with Terraform and Azure likely stem from issues with the format or processing of your PFX (PKCS#12) certificate file. Such errors commonly occur when the certificate is not in the expected format, or when terraform does not completely support the specific cryptographic elements, such as algorithms, used in your certificate.

Make sure you uploaded the correct .cer certificate to the respective service principal and correct path to .pfx location so that will eliminate the un-necessary errors.

My terraform code:

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
    }
  }
  backend "azurerm" {
    resource_group_name  = "vinay-rg"
    storage_account_name = "storagevksb"
    container_name       = "testvk"
    key                  = "terraform.tfstate"
  }
}

provider "azurerm" {
  features {}
  subscription_id = "Sub_ID"
  client_id       = "Client_ID"
  tenant_id       = "Tenent_ID"
  client_certificate_path = "C:\\pathforthefile\\vsbcert.pfx"
  client_certificate_password  = "password"
}

resource "azurerm_resource_group" "test"{
  name = "test-rg"
  location = "east us"
}

Deployment succeeded: