This message was deleted.

Managed to resolve this. Turns out I forgot to include the

profile

in the provider definition, causing Pulumi to looked up the cert in the wrong account.