{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-331-update-linux-certificate-consumers-for-the-key-vault-extension-s-split-file-format/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-331-update-linux-certificate-consumers-for-the-key-vault-extension-s-split-file-format/",
        "slug": "dse-20260909-331-update-linux-certificate-consumers-for-the-key-vault-extension-s-split-file-format",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-331-update-linux-certificate-consumers-for-the-key-vault-extension-s-split-file-format/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-331-update-linux-certificate-consumers-for-the-key-vault-extension-s-split-file-format.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-331-update-linux-certificate-consumers-for-the-key-vault-extension-s-split-file-format/"
        },
        "title": "Update Linux certificate consumers for the Key Vault extension's split-file format",
        "summary": "What must change in an application that expects one combined certificate-and-key file when moving to extension 4.x?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:26:25+00:00",
        "modified_at": "2026-09-10T01:40:03+00:00",
        "reviewed_on": "2026-09-09",
        "reading_minutes": 2,
        "word_count": 250,
        "potentially_affected": "Linux certificate consumers moving from Azure Key Vault VM extension 3.0 to 4.x on a documented supported distribution.",
        "dse_recommendation": "Map the application's chain path, private-key path, reload signal, and file-reading identity before upgrading the extension.",
        "primary_source": {
            "name": "Azure Key Vault virtual machine extension for Linux - Azure Virtual Machines | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/key-vault-linux",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Key Vault&#8217;s Linux extension 4.x separates the certificate chain into a .pem file and the private key into a .keyid file, replacing the combined-file layout of 3.0. Stable symbolic links point at the newest versions, and .luma metadata changes after those links are updated. Configured POSIX ACLs grant private-key read access; ACL enforcement is always enabled. Upgrading leaves previously downloaded files untouched. The documented platforms are Ubuntu 24.04, Azure Linux 3.0/4.0, and RHEL 9 on AMD64 or ARM64. <a href=\"https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/key-vault-linux\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Review an actual 3.0 consumer before adopting the 4.x file contract. Identify whether it reads a combined file, a fixed versioned filename, or a symbolic link. Confirm the distribution against the supported list rather than assuming that every Linux guest can install this handler.</p>\n<h2>DSE recommendation</h2>\n<p>Map the application&#8217;s chain path, private-key path, reload signal, and file-reading identity before upgrading the extension. Update the consumer to the separate files and plan how it will notice a completed renewal. Inspect retained legacy files deliberately; their continued presence should not be mistaken for proof that the application uses the new layout.</p>\n<h2>Verification</h2>\n<p>In an approved test deployment, inspect the two stable links and the application account&#8217;s effective file access. Exercise a certificate renewal and compare the installed version with the certificate actually served by the application. Verify the intended reload behavior without exposing private-key contents in logs. Keep installation success separate from proof that the live process adopted the renewed certificate.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/key-vault-linux\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Key Vault VM extension for Linux</a>. Source reviewed September 9, 2026.</p>",
        "content_text": "Source facts\nKey Vault’s Linux extension 4.x separates the certificate chain into a .pem file and the private key into a .keyid file, replacing the combined-file layout of 3.0. Stable symbolic links point at the newest versions, and .luma metadata changes after those links are updated. Configured POSIX ACLs grant private-key read access; ACL enforcement is always enabled. Upgrading leaves previously downloaded files untouched. The documented platforms are Ubuntu 24.04, Azure Linux 3.0/4.0, and RHEL 9 on AMD64 or ARM64. Microsoft Learn.\nApplicability\nReview an actual 3.0 consumer before adopting the 4.x file contract. Identify whether it reads a combined file, a fixed versioned filename, or a symbolic link. Confirm the distribution against the supported list rather than assuming that every Linux guest can install this handler.\nDSE recommendation\nMap the application’s chain path, private-key path, reload signal, and file-reading identity before upgrading the extension. Update the consumer to the separate files and plan how it will notice a completed renewal. Inspect retained legacy files deliberately; their continued presence should not be mistaken for proof that the application uses the new layout.\nVerification\nIn an approved test deployment, inspect the two stable links and the application account’s effective file access. Exercise a certificate renewal and compare the installed version with the certificate actually served by the application. Verify the intended reload behavior without exposing private-key contents in logs. Keep installation success separate from proof that the live process adopted the renewed certificate.\nOfficial references\nMicrosoft Learn: Key Vault VM extension for Linux. Source reviewed September 9, 2026.",
        "content_markdown": "## Source facts\n\nKey Vault’s Linux extension 4.x separates the certificate chain into a .pem file and the private key into a .keyid file, replacing the combined-file layout of 3.0. Stable symbolic links point at the newest versions, and .luma metadata changes after those links are updated. Configured POSIX ACLs grant private-key read access; ACL enforcement is always enabled. Upgrading leaves previously downloaded files untouched. The documented platforms are Ubuntu 24.04, Azure Linux 3.0/4.0, and RHEL 9 on AMD64 or ARM64. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/key-vault-linux).\n\n## Applicability\n\nReview an actual 3.0 consumer before adopting the 4.x file contract. Identify whether it reads a combined file, a fixed versioned filename, or a symbolic link. Confirm the distribution against the supported list rather than assuming that every Linux guest can install this handler.\n\n## DSE recommendation\n\nMap the application’s chain path, private-key path, reload signal, and file-reading identity before upgrading the extension. Update the consumer to the separate files and plan how it will notice a completed renewal. Inspect retained legacy files deliberately; their continued presence should not be mistaken for proof that the application uses the new layout.\n\n## Verification\n\nIn an approved test deployment, inspect the two stable links and the application account’s effective file access. Exercise a certificate renewal and compare the installed version with the certificate actually served by the application. Verify the intended reload behavior without exposing private-key contents in logs. Keep installation success separate from proof that the live process adopted the renewed certificate.\n\n## Official references\n\n[Microsoft Learn: Key Vault VM extension for Linux](https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/key-vault-linux). Source reviewed September 9, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-331-update-linux-certificate-consumers-for-the-key-vault-extension-s-split-file-format/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-331-update-linux-certificate-consumers-for-the-key-vault-extension-s-split-file-format/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-09"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-331-update-linux-certificate-consumers-for-the-key-vault-extension-s-split-file-format/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Update Linux certificate consumers for the Key Vault extension's split-file format",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-331-update-linux-certificate-consumers-for-the-key-vault-extension-s-split-file-format/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-331-update-linux-certificate-consumers-for-the-key-vault-extension-s-split-file-format/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-331-update-linux-certificate-consumers-for-the-key-vault-extension-s-split-file-format/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-331-update-linux-certificate-consumers-for-the-key-vault-extension-s-split-file-format/",
                "headline": "Update Linux certificate consumers for the Key Vault extension's split-file format",
                "description": "What must change in an application that expects one combined certificate-and-key file when moving to extension 4.x?",
                "abstract": "What must change in an application that expects one combined certificate-and-key file when moving to extension 4.x?",
                "articleBody": "Source facts\nKey Vault’s Linux extension 4.x separates the certificate chain into a .pem file and the private key into a .keyid file, replacing the combined-file layout of 3.0. Stable symbolic links point at the newest versions, and .luma metadata changes after those links are updated. Configured POSIX ACLs grant private-key read access; ACL enforcement is always enabled. Upgrading leaves previously downloaded files untouched. The documented platforms are Ubuntu 24.04, Azure Linux 3.0/4.0, and RHEL 9 on AMD64 or ARM64. Microsoft Learn.\nApplicability\nReview an actual 3.0 consumer before adopting the 4.x file contract. Identify whether it reads a combined file, a fixed versioned filename, or a symbolic link. Confirm the distribution against the supported list rather than assuming that every Linux guest can install this handler.\nDSE recommendation\nMap the application’s chain path, private-key path, reload signal, and file-reading identity before upgrading the extension. Update the consumer to the separate files and plan how it will notice a completed renewal. Inspect retained legacy files deliberately; their continued presence should not be mistaken for proof that the application uses the new layout.\nVerification\nIn an approved test deployment, inspect the two stable links and the application account’s effective file access. Exercise a certificate renewal and compare the installed version with the certificate actually served by the application. Verify the intended reload behavior without exposing private-key contents in logs. Keep installation success separate from proof that the live process adopted the renewed certificate.\nOfficial references\nMicrosoft Learn: Key Vault VM extension for Linux. Source reviewed September 9, 2026.",
                "datePublished": "2026-09-10T00:26:25+00:00",
                "dateModified": "2026-09-10T01:40:03+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-331-update-linux-certificate-consumers-for-the-key-vault-extension-s-split-file-format/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-331-update-linux-certificate-consumers-for-the-key-vault-extension-s-split-file-format/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Update Linux certificate consumers for the Key Vault extension's split-file format"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 250,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Azure Key Vault virtual machine extension for Linux - Azure Virtual Machines | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/key-vault-linux"
                }
            }
        ]
    }
}