[BUG] 'Invalid issuer or signature.' when deploying via Certificate based Apply-PnPProvisioningTemplate

[ghost]

Environment

[X] Office 365 / SharePoint Online
[ ] SharePoint 2016
[ ] SharePoint 2013

Works when using SharePointPnPPowerShellOnline v3.23.2007.1
Every version thereafter (up to current latest 3.25.2009.1) generates the following issue

Expected or Desired Behavior

I should be able to deploy an SPFx application to a tenant using a certificate based authentication:

Connect-PnPOnline -Url $Url -ClientId "myclientid" -Thumbprint "mythumbprint" -Tenant "mytenant"
Apply-PnPProvisioningTemplate -Path ./template.xml

<?xml version="1.0"?>
<pnp:Provisioning xmlns:pnp="http://schemas.dev.office.com/PnP/2019/03/ProvisioningSchema">
    <pnp:Preferences Generator="OfficeDevPnP.Core, Version=3.12.1908.1, Culture=neutral, PublicKeyToken=5e633289e95c321a"></pnp:Preferences>
    <pnp:Tenant>
        <pnp:AppCatalog>
            <pnp:Package Src="..\..\sharepoint\solution\my.sppkg" Action="UploadAndPublish" SkipFeatureDeployment="false" Overwrite="true" />
        </pnp:AppCatalog>
    </pnp:Tenant>
    <pnp:Templates ID="CONTAINER-PORTAL_TENANT_APP">
        <pnp:ProvisioningTemplate ID="PORTAL_TENANT_APP">
        </pnp:ProvisioningTemplate>
    </pnp:Templates>
</pnp:Provisioning>

Observed Behavior

The prior template will fail with the following:

Apply-PnPProvisioningTemplate : {"error_description":"Invalid issuer or signature."}
ServerErrorTraceCorrelationId: e7767e9f-c076-b000-1ee4-fdd82b5a6c10
At C:\deploy\Deploy.ps1:158 char:9
+         Apply-PnPProvisioningTemplate -Path ./template.xml  ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : WriteError: (:) [Apply-PnPProvisioningTemplate], Exception
    + FullyQualifiedErrorId : EXCEPTION,PnP.PowerShell.Commands.Provisioning.Site.ApplyProvisioningTemplate
[2020-09-28 11:08:01.93] -- Error applying template:
{"error_description":"Invalid issuer or signature."}
ServerErrorTraceCorrelationId: e7767e9f-c076-b000-1ee4-fdd82b5a6c10

Steps to Reproduce

Use SharePointPnPPowerShellOnline v3.25.2009.1, create an XML containing a AppCatalog package deployment, run via ClientID/Thumbprint auth. Error generated

[ghost]

Thank you for reporting this issue. We will be triaging your incoming issue as soon as possible.

[ghost]

To clarify this issue, other parts of the template have succeeded, its just the app catalog application upload/publish failing

[ghost]

Got the same error under similar conditions:

In my case this error occures if the template includes the following part:

<pnp:ApplicationLifecycleManagement> <pnp:Apps> <pnp:App AppId="{parameter:AlmAppID}" Action="Install" /> </pnp:Apps> </pnp:ApplicationLifecycleManagement>

[JohnnyKapps]

Got the same error! In my case I'm trying to provision a Office Group (SharePoint Site) with a associated Microsoft Teams Team.
On powershell it works perfectly, but when I try to do it on ASP.Net, this error occurs:

"Invalid issuer or signature."

[pvranich]

Hi I am also getting the same issue with version 3.27.2011 using ASP.NET.

Any progress on this?