[QUERY] Key Vault cert auto-rotation timeline

[avanigupta]

Query/Question
I have a certificate in Key Vault with an auto-rotation policy. I want my application to reload the certificate from Key Vault when a newer version is available. I'm using the Azure.Security.KeyVault.Certificates package to create a CertificateClient and get the KeyVaultCertificateWithPolicy. I then calculate the auto-rotation time of this certificate as defined in the LifetimeActions of the CertificatePolicy. But this time is not always the exact time of auto-rotation in Key Vault. There will always be some margin of error.

Questions:

• How do I calculate the exact time when the new version of certificate will be available in Key Vault?
• Is there a time window between which the certificate is guaranteed to be rotated?

Note: I cannot use Event Grid notifications.

Environment:

• Name and version of the Library package used: Azure.Security.KeyVault.Certificates v4.1.0
• Hosting platform or OS and .NET runtime version (dotnet --info output for .NET Core projects):

dotnet --info
.NET SDK (reflecting any global.json):
Version:   5.0.201
Commit:    a09bd5c86c

Runtime Environment:
OS Name:     Windows
OS Version:  10.0.19042
OS Platform: Windows
RID:         win10-x64
Base Path:   C:\Program Files\dotnet\sdk\5.0.201\

Host (useful for support):
 Version: 5.0.4
 Commit:  f27d337295

.NET SDKs installed:
 3.0.103 [C:\Program Files\dotnet\sdk]
 3.1.407 [C:\Program Files\dotnet\sdk]
 5.0.104 [C:\Program Files\dotnet\sdk]
 5.0.201 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
 Microsoft.AspNetCore.All 2.1.26 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
 Microsoft.AspNetCore.App 2.1.26 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
 Microsoft.AspNetCore.App 3.0.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
 Microsoft.AspNetCore.App 3.1.13 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
 Microsoft.AspNetCore.App 5.0.4 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
 Microsoft.NETCore.App 2.1.26 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
 Microsoft.NETCore.App 3.0.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
 Microsoft.NETCore.App 3.1.13 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
 Microsoft.NETCore.App 5.0.4 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
 Microsoft.WindowsDesktop.App 3.0.3 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
 Microsoft.WindowsDesktop.App 3.1.13 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
 Microsoft.WindowsDesktop.App 5.0.4 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

• IDE and version : Visual Studio 2019, Version 16.9.1

[jsquire]

Thank you for your feedback. Tagging and routing to the team member best able to assist.

[heaths]

@avanigupta, are you saying the time you get back via the SDK doesn't match the service timeout (perhaps displayed in the Portal), or that the key/certificate isn't actually rotated when you expect it to be given the time displayed?

/cc @jlichwa

[jlichwa]

@avanigupta depends on the number of certificates and needed retries the actual time will vary and it is not possible to come up with actual time.
For application to refresh we usually have a job which checks every few hours (i.e. Key Vault VM extension) for new certificate and other option will be to use Event Grid notification which is triggered when there is new version of certificate:
https://docs.microsoft.com/en-us/azure/event-grid/event-schema-key-vault?tabs=event-grid-event-schema

[avanigupta]

@jlichwa , I have a test certificate with the following auto-rotation policy:

• Validity: 1 month
• Percentage lifetime: 1%

So this certificate should rotate every 7.2 hours (as documented here).

However, my certificate is not rotating in anywhere near 7.2 hours. These are all the certificate versions with all event timings (in PDT):

Version	CreatedOn	ExpiresOn	Expected Rotation Time	Actual Rotation Time	Difference
1f5...856	4/9 11:59 AM	5/9 11:59 AM	4/9 7:11 PM	4/10 7:01 PM	23 hrs 50 mins
638...1de	4/10 7:01 PM	5/10 7:01 PM	4/11 2:13 AM	4/12 2:04 AM	23 hrs 51 mins
562...1de	4/12 2:04 AM	5/12 2:04 AM	4/12 9:16 AM	Not rotated yet	NA

Questions:

• I'm assuming that "Actual Rotation Time" is the same as the CreatedOn time of the newer version. Is that correct?
• For my test cert, the difference between actual and expected rotation time is 23:50 hrs. Is is safe to assume that that's always the case?

I cannot use Event Grid notifications or VM extension because I am trying to add auto refresh of certificates in the Azure App Configuration provider library. Therefore, I'm looking for a time frame within which the new certificate version will be available in Key Vault.

[ghost]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @RandalliLama, @schaabs, @jlichwa.

Issue Details

---

Query/Question
I have a certificate in Key Vault with an auto-rotation policy. I want my application to reload the certificate from Key Vault when a newer version is available. I'm using the Azure.Security.KeyVault.Certificates package to create a CertificateClient and get the KeyVaultCertificateWithPolicy. I then calculate the auto-rotation time of this certificate as defined in the LifetimeActions of the CertificatePolicy. But this time is not always the exact time of auto-rotation in Key Vault. There will always be some margin of error.

Questions:

• How do I calculate the exact time when the new version of certificate will be available in Key Vault?
• Is there a time window between which the certificate is guaranteed to be rotated?

Note: I cannot use Event Grid notifications.

Environment:

• Name and version of the Library package used: Azure.Security.KeyVault.Certificates v4.1.0
• Hosting platform or OS and .NET runtime version (dotnet --info output for .NET Core projects):

dotnet --info
.NET SDK (reflecting any global.json):
Version:   5.0.201
Commit:    a09bd5c86c

Runtime Environment:
OS Name:     Windows
OS Version:  10.0.19042
OS Platform: Windows
RID:         win10-x64
Base Path:   C:\Program Files\dotnet\sdk\5.0.201\

Host (useful for support):
 Version: 5.0.4
 Commit:  f27d337295

.NET SDKs installed:
 3.0.103 [C:\Program Files\dotnet\sdk]
 3.1.407 [C:\Program Files\dotnet\sdk]
 5.0.104 [C:\Program Files\dotnet\sdk]
 5.0.201 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
 Microsoft.AspNetCore.All 2.1.26 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.All]
 Microsoft.AspNetCore.App 2.1.26 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
 Microsoft.AspNetCore.App 3.0.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
 Microsoft.AspNetCore.App 3.1.13 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
 Microsoft.AspNetCore.App 5.0.4 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
 Microsoft.NETCore.App 2.1.26 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
 Microsoft.NETCore.App 3.0.3 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
 Microsoft.NETCore.App 3.1.13 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
 Microsoft.NETCore.App 5.0.4 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
 Microsoft.WindowsDesktop.App 3.0.3 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
 Microsoft.WindowsDesktop.App 3.1.13 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
 Microsoft.WindowsDesktop.App 5.0.4 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

• IDE and version : Visual Studio 2019, Version 16.9.1

Author:	avanigupta
Assignees:	heaths
Labels:	KeyVault, Service, Service Attention, needs-team-attention
Milestone:	-

[jlichwa]

@avanigupta the provided example is just for quick testing. 24 hours average seems right. The 23:50 is not guaranteed and can from several hours to few days. We recommend minimum 5 days for rotation. The usual expiry for certificates is 1 year.

I'm not familiar with Azure App Configuration provider library use case, but it seems like but it seems like it has way to expire configuration, so once a day should be enough - it will refresh certificate before expiry (you have expiry 1 month, which means that certificate is valid for entire 30 days)

[avanigupta]

We recommend minimum 5 days for rotation.

Just to confirm, you mean that the auto-rotation policy should be setup such that it kicks in at least 5 days before the cert expires?

I'm not familiar with Azure App Configuration provider library use case, but it seems like but it seems like it has way to expire configuration, so once a day should be enough - it will refresh certificate before expiry (you have expiry 1 month, which means that certificate is valid for entire 30 days)

Yes, we want to refresh the certificate when there is a new version in Key Vault. We are using the auto-rotation time to trigger a request to Key Vault to get the new version. If newer version is not available, we will keep re-trying periodically until a new version is available, or until the current version expires (whichever comes first). Do you recommend making this periodic request every 24 hours?

[jlichwa]

@avanigupta since due to various circumstances there could be up ot 72h delay , rotation more often than every 5 days may not work and yes the other way around is that rotation should be schedule at least 5 days before expiration to be on the safe spot.

So in general the idea is that certificates versions should overlap, so applications has enough time to refresh (at least several days) and with that there is no need for instant refresh (previous certificate is still valid).

We recommend use periodic request every 8-24h (VM Extension, Key Vault references do that) or to avoid periodic calls integrate with NewVersion event (but Im not sure how it is possible with App Configuration - I found that there is an option to refresh on demand, so it can help https://docs.microsoft.com/en-us/azure/azure-app-configuration/enable-dynamic-configuration-dotnet-core-push-refresh