This can happen if you try to re-add the same vault instead of using a new vault certificate for the existing source vault. The Add-AzVmssSecret command doesn't work correctly if you're adding more secrets.
To add more secrets from the same key vault, update the following list: $vmss.properties.osProfile.secrets[0].vaultCertificates.
For the expected input structure, see Create or update a virtual machine set.
Find the secret in the Virtual Machine Scale Set object that is in the key vault. Then, add your certificate reference (the URL and the secret store name) to the list associated with the vault.
Note
Currently, you can't remove certificates from VMs by using the Virtual Machine Scale Set API.
New VMs will not have the old certificate. However, VMs that have the certificate, and that are already deployed, do have the old certificate.