'az webapp config ssl list' returns an empty list

[ghost]

Describe the bug

az webapp config ssl list --resource-group <resource-group> returns [] as the response, while Get-AzWebAppCertificate -ResourceGroupName <resource-group> returns the actual certificates.

It has previously been reported, and supposedly fixed, here:

• #18216
• #19777

(Although my problem doesn't seem to be a caching issue as described in the first issue because running the Get-AzWebAppCertificate first, then az command doesn't make it work)

Related command

az webapp config ssl list --resource-group <resource-group>

and

Get-AzWebAppCertificate -ResourceGroupName <resource-group>

Errors

No errors, just no results.

Issue script & Debug output

I've added --debug to the az command and -Debug to the Get-AzWebAppCertificate command and noticed that Get-AzWebAppCertificate makes this request 👇 to Management API:

https://management.azure.com/subscriptions/<subscription>/resourceGroups/<resource-group>/resources?$filter=resourceType eq 'Microsoft.Web%2FCertificates'&api-version=2016-09-01

While the az command makes a different one:

https://management.azure.com/subscriptions/<subscription>/resourceGroups/<resource-group>/providers/Microsoft.Web/certificates?api-version=2023-01-01

So, maybe the problem is not necessarily the CLI, but that 👆 specific Management API version/request?

Expected behavior

I expect the certificates to be included in the az output.

Environment Summary

I'm running both on Cloud Shell.

> Get-Module -Name Az -ListAvailable

    Directory: /usr/local/share/powershell/Modules

ModuleType Version    PreRelease Name                                PSEdition ExportedCommands
---------- -------    ---------- ----                                --------- ----------------
Script     12.1.0                Az                                  Core,Desk 

$ az --version
azure-cli                         2.62.0

core                              2.62.0
telemetry                          1.1.0

Extensions:
ai-examples                        0.2.5
front-door                         1.2.0
ml                                2.27.0
ssh                                2.0.4

Dependencies:
msal                              1.28.1
azure-mgmt-resource               23.1.1

Python location '/usr/bin/python3.9'
Extensions directory '/home/<name>/.azure/cliextensions'
Extensions system directory '/usr/lib/python3.9/site-packages/azure-cli-extensions'

Python (Linux) 3.9.19 (main, Mar 28 2024, 18:56:59) 
[GCC 11.2.0]

Legal docs and information: aka.ms/AzureCliLegal


Your CLI is up-to-date.

Additional context

Certificates are Microsoft managed.

[yonzhan]

Thank you for opening this issue, we will look into it.

[ghost]

Also, tried on a different machine (Ubuntu 22.04), with a different version of az, still getting an empty list []; --debug says it makes this call:

https://management.azure.com/subscriptions/<subscription>/resourceGroups/<resource-group>/providers/Microsoft.Web/certificates?api-version=2022-03-01

$ az --version
azure-cli                         2.42.0 *

core                              2.42.0 *
telemetry                          1.0.8 *

Extensions:
azure-devops                      0.26.0
containerapp                      0.3.17
front-door                        1.0.17
portal                             0.1.3

Dependencies:
msal                              1.20.0
azure-mgmt-resource             21.1.0b1

Python location '/opt/az/bin/python3'
Extensions directory '/home/<name>/.azure/cliextensions'

Python (Linux) 3.10.8 (main, Oct 28 2022, 04:19:21) [GCC 11.3.0]

Legal docs and information: aka.ms/AzureCliLegal


You have 3 update(s) available. Consider updating your CLI installation with 'az upgrade'

[ghost]

Hey @yonzhan and @seligj95, any updates on this?

Just a bit of context: We have not updated Azure CLI since it last worked; still using the same version 2.42.0 that used to work. However, the last time it ran successfully we were using Ubuntu-20.04-based self-hosted agents version 2.211.1 on Azure DevOps.

We have since upgraded our agents to Ubuntu-22.04-based version 3.227.2 and run it on the new agent, as well as run it on native Ubuntu 22.04 (local machine), both of which fail.

Other than the OS upgrade, which is unlikely to be the cause, It just randomly stopped working and now our production pipelines are broken due to this issue.

Would appreciate if you could prioritise the issues when Microsoft is the cause.

Looking forward to an update 🙏

[ChaiyoKung]

I got same issue.

Here is my Azure CLI version on Ubuntu 22.04.4 LTS (WSL2).

$ az --version
azure-cli                         2.61.0 *

core                              2.61.0 *
telemetry                          1.1.0

Extensions:
containerapp                      0.3.28

Dependencies:
msal                              1.28.0
azure-mgmt-resource               23.1.1

Python location '/opt/az/bin/python3'
Extensions directory '/home/<name>/.azure/cliextensions'

Python (Linux) 3.11.8 (main, May 16 2024, 03:47:28) [GCC 11.4.0]

Legal docs and information: aka.ms/AzureCliLegal


You have 2 update(s) available. Consider updating your CLI installation with 'az upgrade'

[timg83]

Since today I also get this issue on an Azure subscription. We did not have this issue in September.

This still works on other Azure subscriptions. I'm baffled.

[jsjacob]

I am having this issue. I'm running commands in a Linux VM instance. Is there a workaround that allows me to bind the SSL certificate to the App Service?

[slawekkopacz]

Experienced this today. Az versions 2.69.0, 2.74.0