"Invalid algorithm specified" exception when using the Azure Plugin with a certificate in the Windows Certificate Store

[Lumute]

Hi,

I'm trying to create a new cert using the Azure plugin and getting "Invalid algorithm specified" exception, after some troubleshooting found the problem seems to be signing the message to authenticate with Azure, here is the debug output using the Publish-Challenge command to test the plugin:

PS C:\Users\user> Publish-Challenge example.com (Get-PAAccount) faketoken Azure $pArgs -Verbose
VERBOSE: Publishing challenge for Domain example.com with Token faketoken using Plugin Azure and DnsAlias ''.
DEBUG: Loading PAAccount list from disk
DEBUG: Calling Azure plugin to add _acme-challenge.example.com TXT with value KQiek8ndRMS_aANyU6Y8lykmBIr5H0wMG8BoOfzX42I
DEBUG: Checking for cert thumbprint XXXX26B6C2D22B805D569A231F0D48970999DD4F in CurrentUser store.
DEBUG: Private key is type System.Security.Cryptography.RSACryptoServiceProvider
VERBOSE: Authenticating with certificate based credential
DEBUG: ACME Header:
{
"x5t": "SDgmtsLSK4BdVppAzw1IlwmZ3Ss",
"typ": "JWT",
"alg": "RS256"
}
DEBUG: ACME Payload:
{"exp":"1754630587","sub":"2763d407-ef85-4100-8224-XXXXXXXXXXXX","iss":"2763d407-ef85-4100-8224-XXXXXXXXXXXX","jti":"dd4459ce-fe69-44d0-8a35-XXXXXXXXXXXX","aud":"https://login.microsoftonline.com/0742e223-869
3-48ac-8415-XXXXXXXXXXXX/oauth2/token","nbf":"1754626987"}
DEBUG: Signing message using RSA with SHA256
New-Jws : Exception calling "SignData" with "3" argument(s): "Invalid algorithm specified.
"
At C:\Program Files\WindowsPowerShell\Modules\Posh-ACME\4.29.3\Plugins\Azure.ps1:677 char:20

• ... $jwt = New-Jws $privKey $jwtHead $payload -Compact -NoHeaderVali ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [New-Jws], MethodInvocationException
  • FullyQualifiedErrorId : CryptographicException,New-Jws

I could not find any reference of this error anywhere. Is this a problem with the specific certificate used or the way it is stored? I saw a warning message in the plugin documentation about having the certificate stored using CSP and not KSP, using certutil to pull the certificate details I can see the provider use for the certificate in question is "Microsoft Strong Cryptographic Provider", but I have no clue if this is the good or bad one...

[rmbolger]

Hi @Lumute, thanks for reaching out. You might be on the right track with regard to how the Azure auth cert was stored. I'll have to run some tests locally to make sure. It's been a while since I've mucked with this particular code path.

I suppose I should also include some sample code in the docs for importing a cert with the correct provider. Though it'd be great if Microsoft would just fix the .NET libraries so they are capable of getting cert details for the KSP provider as well.

[rmbolger]

P.S. Can you post the certutil output you ran so I can try to replicate more closely? And if there was anything special about how you created the cert to begin with, that would be great as well.

[Lumute]

Hi @rmbolger, thanks a lot for looking into this!

sure, this is the certutil command:

C:\Users\user> certutil -user -verifystore my XXXX26B6C2D22B805D569A231F0D48970999DD4F
my "Personal"
================ Certificate 15 ================
Serial Number: 1adff701fd49cab94f96feca6dxxxxx
Issuer: CN=bla.onmicrosoft.com
 NotBefore: 2024-10-23 9:47 PM
 NotAfter: 2025-10-23 10:07 PM
Subject: CN=bla.onmicrosoft.com
Signature matches Public Key
Root Certificate: Subject matches Issuer
Cert Hash(sha1): XXXX26B6C2D22B805D569A231F0D48970999DD4F
  Key Container = {C623EFC7-FE33-412F-9F66-XXXXXXXXXXXX}
  Unique container name: b88e71408a04d6d40ed5c56f562c0342_e0dd820c-1130-480d-b75f-XXXXXXXXXXXX
  Provider = Microsoft Strong Cryptographic Provider
Private key is NOT exportable
Encryption test passed
Verifies against UNTRUSTED root

CertUtil: -verifystore command completed successfully.

I generated the certificate using this PowerShell command:

New-SelfSignedCertificate -DnsName bla.onmicrosoft.com -CertStoreLocation "Cert:\CurrentUser\My" -FriendlyName "Azure Cert" -KeySpec KeyExchange

I use this certificate to connect the Az PowerShell Module and also Azure Graph for PowerShell Module, both use it the same way without issue, passing the tenant id, app id and thumbprint...