Azure-docs: Issue with the device provisioning service template

[angelbachev]

In article https://docs.microsoft.com/en-us/azure/templates/microsoft.devices/provisioningservices#comments-container it's described that
Microsoft.Devices/provisioningServices template can accept parameter "resources" which is array of certificates but if I pass a certificate template object (https://docs.microsoft.com/en-us/azure/templates/microsoft.devices/provisioningservices/certificates) in this array I get an error
"The request content was invalid and could not be deserialized: 'Could not find member 'certificate' on object of type 'TemplateResource'. Path 'properties.template.resources[0].resources[0].certificate', line 1, position 2438.'. (Code: InvalidRequestContent)".

Here is the template content which gives the error above:

{  
   "$schema":"http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json",
   "contentVersion":"1.0.0.0",
   "parameters":{  
      "name":{  
         "type":"String"
      },
      "location":{  
         "type":"String"
      },
      "skuUnits":{  
         "type":"String"
      },
      "iotHubName":{  
         "type":"String"
      },
      "iotHubConnectionString":{  
         "type":"String"
      },
      "certificateName":{  
         "type":"String"
      },
      "certificate":{  
         "type":"String"
      }
   },
   "resources":[  
      {  
         "type":"Microsoft.Devices/provisioningServices",
         "sku":{  
            "name":"S1",
            "capacity":"[parameters('skuUnits')]"
         },
         "name":"[parameters('name')]",
         "apiVersion":"2017-11-15",
         "location":"[parameters('location')]",
         "properties":{  
            "iotHubs":[  
               {  
                  "connectionString":"[parameters('iotHubConnectionString')]",
                  "location":"[parameters('location')]",
                  "name":"[concat(parameters('iotHubName'),'.azure-devices.net')]"
               }
            ]
         },
         "resources":[  
            {  
               "apiVersion":"2017-11-15",
               "type":"Microsoft.Devices/provisioningServices/certificates",
               "name":"[parameters('certificateName')]",
               "certificate":"[parameters('certificate')]"
            }
         ]
      }
   ]
}

Is it possible to deploy device provisioning service certificate with azure template?
Why I get this error? Is the documentation wrong?
Or there is issue with the service?

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: c743a85c-a1c6-55df-88f1-a99198c6ce85
• Version Independent ID: 1e50c628-075f-d360-fd0a-0fe0286f04b5
• Content: Set up Device Provisioning using an Azure Resource Manager template
• Content Source: articles/iot-dps/quick-setup-auto-provision-rm.md
• Service: iot-dps
• GitHub Login: @BryanLa
• Microsoft Alias: bryanla

[Mike-Ubezzi-MSFT]

@angelbachev Thanks for your inquiry. With regard to your specific issue, the error pertains to a certificate not being present in the configuration where it appears to be required. Do you have a certificate you can use?

[angelbachev]

@Mike-Ubezzi-MSFT Thanks for your reply but I still can't understand what causes the error and how to fix it.
I have created a certificate using https://github.com/Azure/azure-iot-sdk-node/blob/master/provisioning/tools/create_test_cert.js.
I tried:

1. Passed content from XXX_cert.pem file to parameter "certificate" in my template.
2. Passed content from XXX_cert.pem file with removed "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" text to parameter "certificate" in my template.
3. Passed base64 encoded content from XXX_cert.pem file to parameter "certificate" in my template.
4. Passed base64 encoded content from XXX_cert.pem file with removed "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" text to parameter "certificate" in my template.
5. Tried 1-4 with the XXX_key.pem and XXX_fullchain.pem file.

I don't think the problem is in the certificate.
I have successfully created Device provisioning service using the web portal and I manually uploaded the XXX_cert.pem file to the device provisioning service.

[asergaz]

@angelbachev on this quickstart that you opened this issue at, we don't cover how to setup an ARM Template with DPS certificates included. It should be possible though.

This will require some deeper analysis (collect server logs and analyze your certificate, etc.). Can you please file a support request @ https://aka.ms/azsupt and reference this issue in the description? If you do not have access to a support plan, please reach out @ [email protected] with a link to this Doc/Issue as well as your subscription ID and we can help get the support ticket opened for this issue.

Thank you!

[asergaz]

We will now proceed to close this thread. If there are further questions regarding this matter, please tag me in your reply. We will gladly continue the discussion and we will reopen the issue.

[AceLiu21]

@sergaz-msft @angelbachev
I also meet the issue,so kindly if u tell how do u solve this problem ?detail more. Much appreciated!

[gaikovoi]

@asergaz @Mike-Ubezzi-MSFT
Hello,

It is 2020 now and this issue still exists. It is not possible to deploy IOT DPS cert using ARM template. This is not an issue with the cert itself, but with template validation. Something inside the ARM does not properly handle defined schema for "Microsoft.Devices/provisioningServices/certificates"

[asergaz]

@gaikovoi I believe this is by design. please add a new feature request here so it can be voted and added to backlog if approved: https://feedback.azure.com/forums/321918-azure-iot

fyi: @kgremban
Thank you!

[cocowalla]

@asergaz it would be helpful if you could explain a bit about what precisely is by design here, so we know what to request in the backlog?

[kgremban]

@asergaz I believe @wesmc7777 is the right person to tag for awareness on this issue. Thanks.