Do not assume every Service Fabric node retains the same old certificates

Source facts

The Key Vault VM extension retrieves and installs the current certificate version without removing existing certificates. Older versions can therefore remain on an existing node while a newly added scale-set node receives only the current version. Reimaging resets the store to the operating-system image and implicitly removes the earlier versions.

Service Fabric itself does not delete a user-declared certificate. For certificates provisioned as VM or scale-set secrets, deleting the referenced vault item or disabling its referenced version can make later deployments fail. Microsoft Learn.

Applicability

Identify the provisioning mechanism for each certificate before applying these behaviors. Do not infer a node’s certificate history from a successful cluster-wide rotation status or assume a particular reimaging schedule.

DSE recommendation

DSE recommends including both long-lived and newly created nodes in certificate dependency reviews. If an application still needs an earlier certificate, investigate that dependency explicitly rather than relying on its accidental persistence. Keep cleanup decisions separate from rotation completion and review deployment references before changing vault items.

Verification

Compare certificate identifiers and required application access on representative existing, scale-out and reimaged test nodes. Check the current deployment declarations alongside the inventories. Record which version each workload actually needs without collecting private keys. Approve cleanup only after the relevant owners have resolved dependencies and tested the intended lifecycle; finding an old certificate on one machine is not evidence that it will survive replacement elsewhere.

Official references

Microsoft Learn: Manage certificates in a Service Fabric cluster. Source retrieved September 9, 2026.