Key Vault virtual machine extension for Linux - how to delete previous PEM file

Question

question

MichalOrac-4941 asked Apr 27, '22 MarileeTurscak-MSFT edited May 4, '22

Key Vault virtual machine extension for Linux - how to delete previous PEM file

Hi,
I have successfully installed the Key Vault virtual machine extension for Linux on Ubuntu 18.04 (Azure VM).
The certificate from KeyVault is imported in the default store /var/lib/waagent/Microsoft.Azure.KeyVault in PEM format.

How do I ensure that after importing a new version of the certificate, only the current one remains in the store and the old (invalid) is deleted?

This is the current state:
adminmox2@VM2:/var/lib/waagent/Microsoft.Azure.KeyVault$ ls
michalcpqtestwekv1.TestAcme
michalcpqtestwekv1.TestAcme.9c312a9e003b4df8a3a7881b5b149a6c.1651038865.1658814864.PEM
michalcpqtestwekv1.TestAcme.e1d6acf454d6474dab68dfb455e1b048.1650965285.1658741284.PEM

Thank you

azure-key-vault

· 2

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

MarileeTurscak-MSFT · May 04 at 12:27 AM

Hi @MichalOrac-4941,

Have you deleted the actual certificate files as described here?

0 ·

MichalOrac-4941 MarileeTurscak-MSFT · May 04 at 09:14 AM

Hi, @MarileeTurscak-MSFT

if I delete them manually, only the last valid certificate is copied again to the Linux cert store - this is ok.

I'm solving this "challenge" because I want to use acme-bot, which renew every 3 months an SSL cert and store in to keyvault.
From key vault I sync SSL into Linux VM.
Renewed SSL (reissued) I will use in app.js.

0 ·

Answer 1 · 2022-05-04T22:58:10.137Z

MarileeTurscak-MSFT answered May 4, '22 MarileeTurscak-MSFT edited May 4, '22

Hi @MichalOrac-4941,

With Key Vault certificates you cannot just delete a specific version. You cannot do this for any object because Key Vault doesn't care if it is a certificate, key, or secret. If you delete a certificate it deletes it entirely and there is no workaround that I am aware of. Now when you create a new version of any object in Key Vault, the old one is still there but is invalid and no longer used. In your case the certificate versions have a thumbprint which designates them the current version and the certification will not be able to be used unless you download the version with the thumbprint.

![198958-image.png
][1]

Let me know if this helps.

If this answer was helpful, please consider marking as answer so that others in the community with similar searches can more easily find a solution.

image.png (168.7 KiB)

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

question