certificate request failing only for int. prefixed subdomains, all others work.

[kayahk]

Not sure if this is just me or if it's a bug but I am currently lost why the domain int.project.cloud.company.com would not work while dev.project.cloud.company.com works, as well as any other prefix. Also, api.int.project.cloud.company.com works fine.

The error message is:

Exception while executing function: IssueCertificate Orchestrator function 'IssueCertificate' failed: The activity function 'FinalizeOrder' failed: "Failed to deserialize exception from TaskActivity: {"$type":"ACMESharp.Protocol.AcmeProtocolException, ACMESharp","ProblemType":19,"ProblemTypeRaw":"urn:ietf:params:acme:error:unauthorized","ProblemDetail":"Error finalizing order :: CSR does not specify same identifiers as Order","ProblemStatus":403,"Message":"Error finalizing order :: CSR does not specify same identifiers as Order","Data":{"$type":"System.Collections.ListDictionaryInternal, System.Private.CoreLib"},"InnerException":null,"HelpLink":null,"Source":"ACMESharp","HResult":-2146233088,"StackTrace":"   at ACMESharp.Protocol.AcmeProtocolClient.SendAcmeAsync(Uri uri, HttpMethod method, Object message, HttpStatusCode[] expectedStatuses, Boolean skipNonce, Boolean skipSigning, Boolean includePublicKey, CancellationToken cancel, String opName)\r\n   at ACMESharp.Protocol.AcmeProtocolClient.FinalizeOrderAsync(String orderFinalizeUrl, Byte[] derEncodedCsr, CancellationToken cancel)\r\n   at KeyVault.Acmebot.Functions.SharedActivity.FinalizeOrder(ValueTuple`2 input) in /home/runner/work/keyvault-acmebot/keyvault-acmebot/KeyVault.Acmebot/Functions/SharedActivity.cs:line 405\r\n   at Microsoft.Azure.WebJobs.Host.Executors.FunctionInvoker`2.InvokeAsync(Object instance, Object[] arguments) in D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionInvoker.cs:line 53\r\n   at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.InvokeWithTimeoutAsync(IFunctionInvoker invoker, ParameterHelper parameterHelper, CancellationTokenSource timeoutTokenSource, CancellationTokenSource functionCancellationTokenSource, Boolean throwOnTimeout, TimeSpan timerInterval, IFunctionInstance instance) in D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs:line 581\r\n   at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithWatchersAsync(IFunctionInstanceEx instance, ParameterHelper parameterHelper, ILogger logger, CancellationTokenSource functionCancellationTokenSource) in D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs:line 523\r\n   at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithLoggingAsync(IFunctionInstanceEx instance, FunctionStartedMessage message, FunctionInstanceLogEntry instanceLogEntry, ParameterHelper parameterHelper, ILogger logger, CancellationToken cancellationToken) in D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs:line 306"}". See the function execution logs for additional details. 

Did anybody else experience problems with certificate requests for domains starting with int. ?

[shibayan]

This problem may occur if you have already obtained a certificate for the same domain in Key Vault. You may be able to avoid this problem by explicitly entering the name of the certificate and issuing it from the Advanced Option.

[kayahk]

Turns out it was indeed because of a previously issued certificate with the same name, that got deleted and was scheduled to get purged. The soft-delete option prevented it from being deleted immediately, hence it was obviously not possible to reuse the name before the purge date.

Thanks again for your hint.