How to install public key certificate in Azure VM using DSC - powershell

Question

I want to install a public key certificate into an Azure VM scale set using ARM, but have issues getting the local path to the certificate correct.
It is possible to install a certificate using the PowerShell DSC extension for VM scalesets and use the DSC module xCertificate
I am using this code sample:
Configuration Example
{
param
(
[Parameter()]
[string[]]
$NodeName = 'localhost'
)
Import-DscResource -ModuleName xCertificate
Node $AllNodes.NodeName
{
xCertificateImport MyTrustedRoot
{
Thumbprint = 'c81b94933420221a7ac004a90242d8b1d3e5070d'
Location = 'LocalMachine'
Store = 'Root'
Path = '.\Certificate\MyTrustedRoot.cer'
}
}
}
I am using the Publish-AzureRmVMDscConfiguration cmdlet to package and upload the DSC script along with the public key certificate to Azure storage account so it can be used as part of the ARM deployment process.
But I cannot figure out how to resolve the local path to the certicate, I get an error when using
.\Certificate\MyTrustedRoot.cer or $PSScriptRoot\Certificate\MyTrustedRoot.cer
I would think it is possible to either resolve the file in DSC or use relative paths, to keep the DSC configuration simple and packaged together with the certificate.
UPDATE: Publish-AzureRmVMDscConfiguration zips and uploads the DSC script and the public key certificate to an azure storage account. The VMSS DSC extension downloads the zip, unzips locally on the vm and runs DSC, so the certificate is present locally on all vm's in the scaleset.
But the path to the certificate is not deterministic due to version numbers of the DSC module being used.

Answer 1

Well the certificate doesn't exist locally right, it is only in the storage account. So you would need to pass the path to the certificate in storage as a parameter, using the artifactsLocation and artifactsLocationSasToken values to make the uri.
But these are values that you would get from an arm template deployment. As you are just using powershell to publish your DSC plus resources, you should be able to determine what the uri of your cert is. You specify the storage account as a param of the publish cmdlet, so you should be able to build the uri with that information. Double check the uri of the cert in the storage account.
Alternatively, use a custom script extension on the VM to download the cert from storage to the VM, then the cert will exist locally.
Are you doing this all in powershell? You may want to look at using an arm template for this. for eg: Azure Quickstart Templates

Answer 2

Locally on the Azure VMs, the path to the DSC file and the certificate are somewhere under the DSC extension workfolder, extracted from the zip package created by the Publish-AzureRmVMDscConfiguration cmdlet, e.g.
C:\Packages\Plugins\Microsoft.Powershell.DSC\2.23.0.0\DSCWork\InstallRootCaCert.ps1.0\Certificate\MyTrustedRoot.cer
The best solution I could come up with was to use the absolute path to the certificate and lock the the DSC version number by explicitly setting the typeHandlerVersion to 2.23 in the ARM template and setting autoUpgradeMinorVersion to false