Please provide us with the following information:

This issue is a: (mark with an x)

• bug report -> please search issues before submitting
• documentation issue or request
• regression (a behavior that used to work and stopped in a new release)

Issue description

I have obtained my certificate via LetsEncrypt and produced a valid pfx file which I can upload to KeyVault via azure cli but fails when adding to Azure Container App Environment using this command:

az containerapp env certificate upload \    
      --resource-group ${RESOURCE_GROUP} \
      --name ${CONTAINER_APP_ENV_NAME} \
      --certificate-file ${PFX_CERT_PATH} \
      --certificate-name ${CONTAINER_APP_CERTIFICATE_NAME} \
      --password ${PFX_PASSWORD}

The error is:

Certificate must contain one private key.

However, I can upload manually in the portal.azure.com without an issue:

I looked at the pfx file using Mac Keychain Access and it looks like it has a private key with an intermediate key:

Steps to reproduct

See above

Expected behavior

The az containerapp env certificate upload command should succeed.

Actual behavior

I get this error: Certificate must contain one private key.