Linux Flex Consumption plans don't load Certificates for use in code

[jimmywim]

In the documentation on this page:

Load certificates in Linux/Windows containers

It says to load certificates you load directly from file:

var cert = X509CertificateLoader.LoadCertificateFromFile("/var/ssl/certs/<thumbprint>.der");

or for keys:

var cert = X509CertificateLoader.LoadCertificateFromFile("/var/ssl/private/<thumbprint>.p12");

However, neither of these appear to work. I'm trying to load a private key to be able to authenticate to SharePoint using an AppId and a Certificate, but the error being thrown here is ASN1 corrupted data.

The certificate has been loaded into Bring Your Own .pfx and imported via Azure Key Vault. All checks are green on the certificate details within BYO. The thumbprint is added to WEBSITE_LOAD_CERTIFICATES in Environment Variables. The function app has been restarted several times, but for whatever reason, the certificate is unable to load.

I do note that on here: https://stackoverflow.com/questions/79642574/azure-certificates-are-unable-to-copy-to-linux-app-service there appeared to be a similar issue with the paths not being created, however I did get a similar "Not found" issue until I realised I had the path wrong (certs vs private for loading the private key).

Is there something missing from Flex Consumption Plan implementation, or a difference in the documentation that needs to be updated?

Does there need to be a page on the Azure Functions documentation to call out using certificates in Flex Consumption plans?

[jimmywim]

UPDATE: OK I think it's something with how the certificates are pulled in, and it may just require a documentation update.

I checked the other methods in X509CertificateLoader and I've found this actually works:

var certPath = $"/var/ssl/private/{thumbprint}.p12";
 var cert = X509CertificateLoader.LoadPkcs12FromFile(certPath, "");

The documentation states to use LoadCertificateFromFile which I think is expecting the certificate to be in a specific format (note: no password required), however LoadPkcs12FromFile does require a password, but if you pass in an empty string it works (This may be an artifact of Key Vault).