Split - Merge :Shardlet Move using cr.microsoft.com/splitmerge/splitmergeworker:20240812.1, gettingMicrosoft.Azure.SqlDatabase.ElasticScale.SplitMerge.Worker.SplitMergeOperationFailedException: Bad Key while sending the request from UI

Hello Deepak Raj

Just checking in to see if the above answer helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Thanks

Pratyush

I tried the steps mentioned but that didnt work.

I found nothing with "Set-Location Cert:\LocalMachine\My" but was able to locate certificate on the windows container at "C:\appservice\certificates\private"

You mentioned "It states: "If you receive the following error, it's most likely a problem with your Web endpoint's certificate. Try connecting to the Web endpoint with your favorite browser or REST tool. If you see SSL errors, the certificate is either not installed or there are thumbprint issues.""

Do you know which endpoints are exposed and the details required to call those through Postman or a console application ?

Hello Deepak Raj,

Thank you for providing those additional details. This is very helpful information.

Your discovery that the certificate is not found in Cert:\LocalMachine\My is the key to solving this issue. This confirms the root cause: the worker application cannot access the certificate's private key because the certificate is not being loaded into the correct Windows certificate store where the .NET framework expects to find it. The CryptographicException: Bad Key error is a direct result of this.

Let's address both of your points.

1. Fixing the Certificate Loading Issue

The fact that you can see the certificate file at C:\appservice\certificates\private but not in the certificate store strongly indicates an issue with the WEBSITE_LOAD_CERTIFICATES application setting on your worker App Service.

Let's re-verify it with extreme care.

1. The thumbprint must be an exact match, copied directly from the certificate details. Sometimes invisible characters or incorrect characters (like a ? from copy-pasting) can cause it to fail silently. Please try re adding existing WEBSITE_LOAD_CERTIFICATES setting on the worker App Service. Re-add it, being careful to paste the thumbprint value cleanly. There should be no leading or trailing spaces.
2. After adding or modifying an app setting, especially WEBSITE_LOAD_CERTIFICATES, you must restart the App Service for the change to take effect. In the Azure Portal for your worker App Service, go to the Overview blade and click Restart.
3. After the restart is complete, please run the Kudu PowerShell command again. powershell

      Set-Location Cert:\LocalMachine\My
   

   • If the setting is now correct, your certificate should appear in this list. This is the most important verification step. If it appears here, the original split-merge operation will likely succeed.

2. Split-Merge Service Endpoints

You are correct to want to test the endpoint directly to check the TLS/SSL certificate. The Split-Merge "worker" application you deployed is an ASP.NET Web API. Its endpoints are hosted at the URL of the App Service itself.

Endpoint URL:

• The base URL is simply the default URL of your worker App Service: https://<your-split-merge-worker-app-name>.azurewebsites.net

1. How you can test:
   • Using a Browser: The easiest test is to simply navigate to that base URL in your web browser. You should see a lock icon, and if you inspect the certificate details, it should be the one you uploaded. You will likely get a 403 Forbidden or 404 Not Found page error, which is expected and normal. We are only testing the TLS/SSL connection, not the API functionality. If you do not get a browser warning about an invalid certificate, then the TLS binding is configured correctly.
   • Using Postman/cURL: You can make a GET request to the base URL. The specific API routes for submitting jobs (like /api/splitmerge/) require POST requests with specific payloads and would be difficult to test manually. The goal here is just to validate the SSL handshake.
   A simple CURL command would be:

      curl -v https://<your-split-merge-worker-app-name>.azurewebsites.net
   

   Look for the "SSL certificate verify ok" message in the verbose output.

Action Plan summarized below:

1. Focus on the worker App Service.
2. Carefully re-create the WEBSITE_LOAD_CERTIFICATES app setting with the exact thumbprint.
3. Restart the App Service.
4. Confirm via the Kudu PowerShell command that the certificate now appears in Cert:\LocalMachine\My.
5. Once it appears in the store, retry your split-merge operation from the UI.

Please let me know how it goes after you perform these steps.

Thank you