[KeyVault] Unable to create self-signed certificate with Azure CLI 2.0 with PowerShell

Description

When trying to create a self-signed certificate, it generates a JSON parsing error.

az keyvault certificate create --vault-name my-keyvault -n cert1 -p "$(az keyvault certificate get-default-policy)"

I also tried to put the actual JSON content instead of the command interpolation. I also tried to escape the actual JSON content, etc.

Nothing seems to work.

Expecting property name enclosed in double quotes: line 1 column 5 (char 4)

What I’m expecting is to be able to either pass the filename in a parameter so that it can be read and deserialized properly or pass the content of the file in a reasonably formatted fashion.

---

Environment summary

Install Method: How did you install the CLI? (e.g. pip, interactive script, apt-get, Docker, MSI, nightly)
Answer here: MSI

CLI Version: What version of the CLI and modules are installed? (Use az --version)
Answer here: azure-cli (2.0.18)

acr (2.0.12) acs (2.0.16) appservice (0.1.17) backup (1.0.1) batch (3.1.4) billing (0.1.5) cdn (0.0.9) cloud (2.0.8) cognitiveservices (0.1.8) command-modules-nspkg (2.0.1) component (2.0.7) configure (2.0.11) consumption (0.1.5) container (0.1.11) core (2.0.17) cosmosdb (0.1.13) dla (0.0.12) dls (0.0.14) eventgrid (0.1.4) extension (0.0.3) feedback (2.0.6) find (0.2.7) interactive (0.3.10) iot (0.1.12) keyvault (2.0.11) lab (0.0.11) monitor (0.0.10) network (2.0.15) nspkg (3.0.1) profile (2.0.13) rdbms (0.0.7) redis (0.2.9) resource (2.0.15) role (2.0.12) servicefabric (0.0.4) sql (2.0.12) storage (2.0.16) vm (2.0.15)

OS Version: What OS and version are you using?
Answer here: Windows 10 version 1703 (OS Build 15063.632)

Shell Type: What shell are you using? (e.g. bash, cmd.exe, Bash on Windows)
Answer here: PowerShell

[tjprescott]

Fixed by PR #4628.

[MaximRouiller]

Issue:

Doing az keyvault certificate get-default-policy > defaultpolicy.json would generate a file UTF-16LE encoded under PowerShell and UTF-8 under Bash or CMD.

Although, azure-cli is supposed to handle it… my bet is that it fails to detect UTF-16LE and uses UTF-16 instead which transforms it to a deserialization error instead of an encoding error.

Workaround for those walking this path in the future:

az keyvault certificate get-default-policy | Out-File -Encoding utf8 defaultpolicy.json

This forces the encoding to UTF-8 and the az command can now be used properly in PowerShell like so by escaping the @.

az keyvault certificate create --vault-name my-keyvault -n cert --policy `@defaultpolicy.json