What you need to know
What must change in an application that expects one combined certificate-and-key file when moving to extension 4.x?
Potentially affected
Linux certificate consumers moving from Azure Key Vault VM extension 3.0 to 4.x on a documented supported distribution.
DSE recommendation
Map the application's chain path, private-key path, reload signal, and file-reading identity before upgrading the extension.
Source facts
Key Vault’s Linux extension 4.x separates the certificate chain into a .pem file and the private key into a .keyid file, replacing the combined-file layout of 3.0. Stable symbolic links point at the newest versions, and .luma metadata changes after those links are updated. Configured POSIX ACLs grant private-key read access; ACL enforcement is always enabled. Upgrading leaves previously downloaded files untouched. The documented platforms are Ubuntu 24.04, Azure Linux 3.0/4.0, and RHEL 9 on AMD64 or ARM64. Microsoft Learn.
Applicability
Review an actual 3.0 consumer before adopting the 4.x file contract. Identify whether it reads a combined file, a fixed versioned filename, or a symbolic link. Confirm the distribution against the supported list rather than assuming that every Linux guest can install this handler.
DSE recommendation
Map the application’s chain path, private-key path, reload signal, and file-reading identity before upgrading the extension. Update the consumer to the separate files and plan how it will notice a completed renewal. Inspect retained legacy files deliberately; their continued presence should not be mistaken for proof that the application uses the new layout.
Verification
In an approved test deployment, inspect the two stable links and the application account’s effective file access. Exercise a certificate renewal and compare the installed version with the certificate actually served by the application. Verify the intended reload behavior without exposing private-key contents in logs. Keep installation success separate from proof that the live process adopted the renewed certificate.
Official references
Microsoft Learn: Key Vault VM extension for Linux. Source reviewed September 9, 2026.
Review the official source
Azure Key Vault virtual machine extension for Linux - Azure Virtual Machines | Microsoft Learn · Verified September 9, 2026
Need help applying this guidance safely?
DSE can help confirm applicability, protect service continuity, and validate the result across physical security and IT systems.
Talk with DSE