I am trying to install KeyVaultForLinux extensions 4.x version in my ubuntu 24.04 but facing issues

Question

I am trying to install KeyVaultForLinux extensions 4.x version in my ubuntu 24.04 but facing issues

Indukuri, Bala Sai Varma(IT) (Consultant) 5

Hi Team,

I am trying to install the KeyVaultForLinux extension (4.x) on an Ubuntu 24.04 VM, but I am encountering an issue during deployment.

Environment Details:

Using the VM's Managed Identity for authentication.
The Managed Identity already has the required access permissions to the Azure Key Vault (AKV).

Issue: The deployment fails during the certificate and private key validation step. The error indicates a certificate/key mismatch.

However:

The certificate stored in the Key Vault is valid and has been in use for a long time without any issues.
The certificate was originally uploaded to the Key Vault as a PFX.
Manual validation of the certificate and private key does not show any mismatch.
Other services using the same certificate have been working successfully. (EX: in AppGW with AKV linked)

Since the certificate can be retrieved successfully but the validation fails only within the KeyVaultForLinux extension, I would like to understand:

Is there any bug from Microsoft side which is failing for this validation?
Are there additional validation requirements enforced by the extension that could cause this mismatch error?
Any guidance would be greatly appreciated.

Error:

2026-08-28 06:42:55: <info> [CertificateManager] Installing previous version '91129cb365f64212afe20097a46f5d30' of 'https://<ForSecurityRemovedAKVName>.vault.azure.net/secrets/<RemovingCertName>'

2026-08-28 06:42:55: <debug> [AuthClientDelegator] delegating to MSI auth client

2026-08-28 06:42:55: <debug> [AuthClient] acquiring token

2026-08-28 06:42:55: <debug> [UnixKeyVaultHttpClient] Using CAfile for TLS: /etc/ssl/certs/ca-certificates.crt

2026-08-28 06:42:55: <debug> [UnixKeyVaultHttpClient] Using CApath for TLS: /etc/ssl/certs

2026-08-28 06:42:55: <info> [UnixCertificateStore] attempting to open store '/etc/nginx/test-ssl'

2026-08-28 06:42:55: <info> [Certificate] Loaded 2 intermediate/root certificate(s) from PEM

2026-08-28 06:42:55: <error> [CertificateManager] Refreshing 'https://<ForSecurityRemovedAKVName>.vault.azure.net/secrets/<RemovingCertName>' failed with exception: InitFromPEM: Mismatched X509 and private key.: error:05800074:x509 certificate routines::key values mismatch

2026-08-28 06:42:55: <error> [CertificateManager] Failed to install previous version '91129cb365f64212afe20097a46f5d30' of 'https://<ForSecurityRemovedAKVName>.vault.azure.net/secrets/<RemovingCertName>'

2026-08-28 06:42:55: <error> [CertificateManager] Failed to download one or more certificates.

2026-08-28 06:42:55: <error> [CertificateManager] Retrying after failed download cycle.

2026-08-28 06:42:55: <info> [CertificateManager] Next poll in 45 seconds.

2026-08-28 06:42:55: <info> [UnixCertificateManager] Checking state of termination event with a timeout of 45999

2026-08-28 06:43:41: <debug> [CertificateManager] POLLING_RANDOMIZATION_RANGE_SEC: 300, RandomMS: 179000

2026-08-28 06:43:41: <info> [CertificateManager] Starting refreshing observed certificates...

2026-08-28 06:43:41: <info> [CertificateManager] Beginning refresh for: https://<ForSecurityRemovedAKVName>.vault.azure.net/secrets/<RemovingCertName>

2026-08-28 06:43:41: <debug> [AuthClientDelegator] delegating to MSI auth client

2026-08-28 06:43:41: <debug> [AuthClient] acquiring token

2026-08-28 06:43:41: <debug> [UnixKeyVaultHttpClient] Using CAfile for TLS: /etc/ssl/certs/ca-certificates.crt

2026-08-28 06:43:41: <debug> [UnixKeyVaultHttpClient] Using CApath for TLS: /etc/ssl/certs

2026-08-28 06:43:42: <info> [CertificateManager] Installing previous version '91129cb365f64212afe20097a46f5d30' of 'https://<ForSecurityRemovedAKVName>.vault.azure.net/secrets/<RemovingCertName>'

2026-08-28 06:43:42: <debug> [AuthClientDelegator] delegating to MSI auth client

2026-08-28 06:43:42: <debug> [AuthClient] acquiring token

2026-08-28 06:43:42: <debug> [UnixKeyVaultHttpClient] Using CAfile for TLS: /etc/ssl/certs/ca-certificates.crt

2026-08-28 06:43:42: <debug> [UnixKeyVaultHttpClient] Using CApath for TLS: /etc/ssl/certs

2026-08-28 06:43:42: <info> [UnixCertificateStore] attempting to open store '/etc/nginx/test-ssl'

2026-08-28 06:43:42: <info> [Certificate] Loaded 2 intermediate/root certificate(s) from PEM

2026-08-28 06:43:42: <error> [CertificateManager] Refreshing 'https://<ForSecurityRemovedAKVName>.vault.azure.net/secrets/<RemovingCertName>' failed with exception: InitFromPEM: Mismatched X509 and private key.: error:05800074:x509 certificate routines::key values mismatch

2026-08-28 06:43:42: <error> [CertificateManager] Failed to install previous version '91129cb365f64212afe20097a46f5d30' of '<ForSecurityRemovedAKVName>.vault.azure.net/secrets/<RemovingCertName>'

2026-08-28 06:43:42: <error> [CertificateManager] Failed to download one or more certificates.

2026-08-28 06:43:42: <error> [CertificateManager] Retrying after failed download cycle.

2026-08-28 06:43:42: <info> [CertificateManager] Next poll in 33 seconds.

2026-08-28 06:43:42: <info> [UnixCertificateManager] Checking state of termination event with a timeout of 33999

0 comments

1 answer

Your answer

Answer 1

Jose Benjamin Solis Nolasco 12,281 Volunteer Moderator

Welcome to Microsoft Q&A!

Hello @Indukuri, Bala Sai Varma(IT) (Consultant)

The error key values mismatch occurs because the KeyVaultForLinux extension uses strict OpenSSL validation that requires the leaf (end-entity) certificate to be the very first certificate in the bundle. While services like Application Gateway automatically match the private key across the bundle, Linux fails if an intermediate or root CA certificate is placed before the leaf.

Additionally, notice this line in your log:

Installing previous version '91129cb365f64212afe20097a46f5d30'

The extension downloads both the current and the previous version. If that older version has an improper chain order, the entire extension fails.

Try this it worked for me a little while ago:

1. Disable the Broken Older Version

Go to Azure Key Vault > Certificates > select your certificate.
Open the Older Versions list, click version 91129cb365f64212afe20097a46f5d30, and set Enabled to No. This stops the extension from trying to install it.

2. Rebuild the Certificate Bundle (Leaf First)

When uploading a new PFX/PEM, ensure the chain is ordered strictly as: Leaf Certificate -> Intermediate CA -> Root CA.

Bash

# Combine with the leaf certificate first

cat leaf.crt intermediate.crt root.crt > fullchain.crt

# Export to PFX

openssl pkcs12 -export -out newcert.pfx -inkey private.key -in fullchain.crt

Upload the newly generated PFX as a new version to Key Vault, and the extension will sync successfully.

References:

Azure Key Vault VM extension for Linux

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.

Indukuri, Bala Sai Varma(IT) (Consultant) 5 Reputation points

2026-08-31T12:35:06.9066667+00:00
Hi @Jose Benjamin Solis Nolasco ,

Thank you for looking into this.

We validated the PKCS#12 bundle exported from Key Vault and inspected its contents using OpenSSL.

Steps performed:

az keyvault secret show ... > cert.b64

base64 -d cert.b64 > cert.pfx

openssl pkcs12 -legacy -in cert.pfx -nodes

The PKCS#12 structure contains:

Private Key

Certificate #1 (Leaf / End-Entity)

Subject: <redacted>

Issuer : <Intermediate CA>

Certificate #2 (Intermediate CA)

Subject: <Intermediate CA>

Issuer : <Root CA>

Certificate #3 (Root CA)

Subject: <Root CA>

Issuer : <Trust Anchor>

The first certificate in the PKCS#12 is the leaf/end-entity certificate. The remaining certificates follow as Intermediate CA and Root CA.

Based on this validation, the certificate order appears to be:

Private Key -> Leaf Certificate -> Intermediate CA -> Root CA

We checked the PFX using OpenSSL and confirmed that the leaf certificate is first in the chain, followed by the intermediate and root certificates. The PFX also contains the associated private key.

Could there be another cause for the key values mismatch error besides certificate ordering?
Mark Wilkerson 0 Reputation points

2026-09-01T15:19:54.45+00:00

In my case, I'm seeing this issue with a certificate issued by Lets Encrypt and stored in our Key Vault. Version "123" of the certificate expires in a few days and version "456" expires in a month or two. The options provided are not valid. I cannot disable the older version due to unknown production dependencies and I can't rebuild the certificate bundle because it's coming from a trusted third party provider.

There are several older, expired, enabled versions of the certificate in the vault that KeyVaultForLinux 4.1 is not trying to process. It seems to only have issues with certificates that are enabled and not expired. I won't be able to confirm this condition until after certificate version "123" expires in a few days.

Ubuntu 24.04 KeyVaultForLinux 4.1.3524.84888 is the only product experiencing this issue in our environment.
Indukuri, Bala Sai Varma(IT) (Consultant) 5 Reputation points

2026-09-01T18:54:51.4933333+00:00

Hi @Mark Wilkerson ,

Just for confirmation, may I know you are also facing the similar error - "f****ailed with exception: InitFromPEM: Mismatched X509 and private key.: error:05800074:x509 certificate routines::key values mismatch" in KeyVaultForLinux extensions 4.x version?
Indukuri, Bala Sai Varma(IT) (Consultant) 5 Reputation points

2026-09-01T19:52:07.7733333+00:00

Hi @Jose Benjamin Solis Nolasco ,

Greetings!

I even tried the process which you mentioned and tried to re install the extension with the latest certificate. Still facing the similar issue.

Below is the process I followed.

Bash

# Combine with the leaf certificate first

cat leaf.crt intermediate.crt root.crt > fullchain.crt

# Export to PFX

openssl pkcs12 -export -out newcert.pfx -inkey private.key -in fullchain.crt

Upload the newly generated PFX as a new version to Key Vault, and the extension will sync successfully.
Mark Wilkerson 0 Reputation points

2026-09-02T17:53:09.2833333+00:00

@Indukuri, Bala Sai Varma(IT) (Consultant)
Correct. Since attempting to use KeyVaultForLinux 4.1.3524.84888 on Ubuntu 24.04 to retrieve a trusted third party CA signed certificate, I see these entries in akvvm_service_....log files. I successfully retrieved the same certificate using KeyVaultForLinux 3.5.3041.185 on Ubuntu 24.04, no issues at all.

2026-09-02 13:03:23: <info> [UnixCertificateStore] attempting to open store '/etc/ssl/certs/keyvault'

2026-09-02 13:03:23: <info> [Certificate] Loaded 2 intermediate/root certificate(s) from PEM

2026-09-02 13:03:23: <error> [CertificateManager] Refreshing 'https://sanitizedkeyvaultname.vault.azure.net/secrets/sanitizedcertificatename' failed with exception: InitFromPEM: Mismatched X509 and private key.: error:05800074:x509 certificate routines::key values mismatch

2026-09-02 13:03:23: <error> [CertificateManager] Failed to download one or more certificates.

2026-09-02 13:03:23: <info> [CertificateManager] Next poll in 3464 seconds.

2026-09-02 13:03:23: <info> [UnixCertificateManager] Checking state of termination event with a timeout of 3464999

For now I will remain on KeyVaultForLinux 3.5.3041.185 for my Ubuntu 24.04 deployments but I was hoping to upgrade KeyVaultForLinux to the latest version in the future.
Indukuri, Bala Sai Varma(IT) (Consultant) 5 Reputation points

2026-09-02T17:56:21.9866667+00:00

Hi @Mark Wilkerson ,

Yes, the same scenario for me as well. 3.x is working and 4.x is not with same errors in ubuntu 24.04.

Hoping for a fix from Microsoft in the upcoming days.