- Notifications
You must be signed in to change notification settings - Fork1.1k
chore: update azure certs#21265
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Conversation
249257d to3afdf39Compare
Emyrk left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Readinghttps://learn.microsoft.com/en-us/azure/security/fundamentals/azure-ca-details?tabs=root-and-subordinate-cas-list, I think@code-asher's take makes sense.
It seems some RSA certs were replaced by ECC, and why there are more now.
I think we need to actually test this with some azure instances, and we have to test it after January 6 according to the blog post.
Since no certs are remove, I will approve.
@code-asher can we create an issue to test said certs against a vm after Jan 6?
3afdf39 toa288971Comparecode-asher commentedDec 15, 2025
Openedcoder/internal#1198 so we can test after 1/6. |
871ed12 intomainUh oh!
There was an error while loading.Please reload this page.
Uh oh!
There was an error while loading.Please reload this page.
Some of these certs expired earlier this year, but I have left them in because I am still not sure I understand the impact or how to test.
We got a notice saying there are new sub-CAs so I went ahead and added all the "issuing" ones but I am not 100% sure this is correct. The documentation is not explicit about which certificates are necessary for signature verification.
@kylecarbs would you happen to have additional context? In thePR the ECC ones were not added and of the RSA ones only the
xsignvariant was included, is that all we need?Closescoder/internal#1147
Edit: decided to add just the ECC
xsignvariants (RSA ones were already bundled). We think these are probably the ones we need (the public key is the same as the non-xsignvariants). However these certs do expire in August, so likely they will need to be replaced soon...