Application Gateway not able to import certificate from key vault

Hello everyone, my first question in this forum.

I am stuck at importing a certificate from the Azure key vault into the Application Gateway. Basically we want the AGW to be the TLS termination point so that everything behind it is http only (AGW as reverse proxy with some path-based direction).

AGW -> Add Listener -> (public https 443, create new cert, choose a certificate from key vault)
I can see my vault, I can see my cert, when I add my identity it says:

"This key vault doesn't allow access to the managed identity. If using role-based access control permission model instead of policy."

I have played for a long time with the access permissions of the managed identity and I can't get it right.

In my key vault, there is no Access Policy. It says Access Policies not available. In its role assignments, I have created a managed identity called "vaultManagedIdentity" with "Key Vault Certificates Officer" role. I've added this MI to the Application Gateway as a "Contributor". I've tried everything there, including owner. Same result.