Azure / Azure/azure-rest-api-specs
[FEATURE REQ] Return root and intermediate certificates in /certificates
- Dominant language
- TypeSpec
- Stars
- 3.1k
- Forks
- 5.9k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 424
Description
### API Spec link
https://learn.microsoft.com/en-us/rest/api/keyvault/certificates/get-certificate/get-certificate?view=rest-keyvault-certificates-7.4&tabs=HTTP
### API Spec version
7.4
### Please describe the feature.
After importing our PFX which contained the full certificate chain, we are not able to get the root and intermediate certificates from `/certificates` endpoint. Our signing tool which uses the Azure KeyVault REST API requires the full public certificate chain. In order to get the certificate chain, we have to use `/secrets` instead which doesn't make sense since these root and intermidate certificates are public and not secret.
Ideally we would want a user to only have to hit the `/certificate` endpoint and `/sign` endpoint. We don't want direct access to the private key from `/secrets`.
This is the difference between giving the user access to:
* Key Vault Reader
* Key Vault Crypto User
Such a user would only have access to `/certificate` and `/sign`.
Instead of:
* Key Vault Certificate User
* Key Vault Crypto User
Such a user would have access to `/certificate` and `/sign` and `/secrets`.
Since the `Get-Certificate` response is already using JSONWebToken, it would be possible to return these certificates as `x5c` parameter. https://mojoauth.com/glossary/jwt-x.509-certificate-chain/
Contributor guide
Research direction
Start with the Azure Key Vault Get-Certificate API specification, version 7.4, and compare the /certificates response with the chain currently exposed through /secrets. Done means the certificate endpoint returns the imported root and intermediate certificates, such as through an x5c chain, without requiring access to /secrets.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, openapi
- Domain
- api, cloud
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100