Azure / Azure/azure-rest-api-specs

[FEATURE REQ] Return root and intermediate certificates in /certificates

Open
#34,858 1 comment 1 reaction 0 assignees View on GitHub
customer-reported feature-request KeyVault question Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
3d 2h
Merged PRs (30d)
424

Description

### API Spec link

https://learn.microsoft.com/en-us/rest/api/keyvault/certificates/get-certificate/get-certificate?view=rest-keyvault-certificates-7.4&tabs=HTTP

### API Spec version

7.4

### Please describe the feature.

After importing our PFX which contained the full certificate chain, we are not able to get the root and intermediate certificates from `/certificates` endpoint. Our signing tool which uses the Azure KeyVault REST API requires the full public certificate chain. In order to get the certificate chain, we have to use `/secrets` instead which doesn't make sense since these root and intermidate certificates are public and not secret.

Ideally we would want a user to only have to hit the `/certificate` endpoint and `/sign` endpoint. We don't want direct access to the private key from `/secrets`.

This is the difference between giving the user access to:

* Key Vault Reader
* Key Vault Crypto User

Such a user would only have access to `/certificate` and `/sign`.

Instead of:

* Key Vault Certificate User
* Key Vault Crypto User

Such a user would have access to `/certificate` and `/sign` and `/secrets`.

Since the `Get-Certificate` response is already using JSONWebToken, it would be possible to return these certificates as `x5c` parameter. https://mojoauth.com/glossary/jwt-x.509-certificate-chain/

Contributor guide

Open the contributing guide

Research direction

Start with the Azure Key Vault Get-Certificate API specification, version 7.4, and compare the /certificates response with the chain currently exposed through /secrets. Done means the certificate endpoint returns the imported root and intermediate certificates, such as through an x5c chain, without requiring access to /secrets.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, openapi
Domain
api, cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.