how to bind key vault certificate to apns notification hub

问题

I've got arm that creates notification hub instance I imported certificate with password into key vault, and now I want to use that certificate as apns of notification hub for apple.

I am trying something like this but always get bad request:

  "type": "Microsoft.NotificationHubs/namespaces/notificationHubs",
  "apiVersion": "2017-04-01",
  "name": "[concat(parameters('namespaces_nhn_ecosystem_name'), '/nh-ecosystem-', parameters('environmentSuffix'))]",
  "location": "[resourceGroup().location]",
  "dependsOn": [
    "[resourceId('Microsoft.NotificationHubs/namespaces', parameters('namespaces_nhn_ecosystem_name'))]"
  ],
  "properties": {
    "authorizationRules": [],
    "apnsCredential": {
      "properties": {
        "apnsCertificate": "apns-cert-secret", <-name of the certificate in key vault 
        "certificateKey": "certpasswordhere",
        "endpoint": "gateway.sandbox.push.apple.com"
      }
    }
  }

来源：https://stackoverflow.com/questions/58130771/how-to-bind-key-vault-certificate-to-apns-notification-hub