service-fabric: EventStore Events has No Items to Display and Indicates an Error Message

I can’t believe you would recommend using issuer thumbprint when service fabric team has announced in blog post that thumbprints are basically evil. If other customers feel the same way, please let your opinion be known.

https://blogs.msdn.microsoft.com/azureservicefabric/2018/04/27/secrets-management-through-certificate-common-names/

Please reconsider.

Yep, I am not fully happy with this either. There exists no good reason to require certificateIssuerThumbprint for a certificate that is totally valid and issued by trusted root CA.

Cluster also doesn’t require it. It’s only EventStore and BackupRestoreService that do.

Managing IssuerThumbprints is unnecessary burden as it’s totally normal that the Issuer might change when certificates are renewed/new certificates are bought.

@ibabou I was finally able to figure out what is causing the issue. It seems the EventStore and BackupRestoreService both can’t be reached when cluster certificate is bound by common name.

That is too bad because using common name to bind the certificate is considered a best practice: https://docs.microsoft.com/en-us/azure/service-fabric/service-fabric-best-practices-security#secure-a-service-fabric-cluster-certificate-by-common-name https://docs.microsoft.com/fi-fi/azure/service-fabric/service-fabric-production-readiness-checklist

Hopefully something can be done to work around this issue?

Here are the specific changes I made to fix the issue:

Before:

    "virtualMachineProfile": {
     ...
                "certificate": {
                  "commonNames": [
                    "[parameters('certificateCommonName')]"
                  ],
                  "x509StoreName": "[variables('certificateStoreName')]"
                }

  "type": "Microsoft.ServiceFabric/clusters",
   ...
    "certificateCommonNames": {
      "commonNames": [
        {
          "certificateCommonName": "[parameters('certificateCommonName')]",
          "certificateIssuerThumbprint": ""
        }
      ],
      "x509StoreName": "[variables('certificateStoreName')]"
    }

After:

    "virtualMachineProfile": {
     ...
                "certificate": {
                  "thumbprint": "<mythumbrint>",
                  "x509StoreName": "[variables('certificateStoreName')]"
                }

  "type": "Microsoft.ServiceFabric/clusters",
   ...
    "certificate": {
      "thumbprint": "<mythumbrint>",
      "x509StoreName": "[variables('certificateStoreName')]"
    },