Azure Attested metadata usage and certificate verification

Question

Hello, with regard of the announcement "Azure Instance Metadata Service-Attested data TLS: Critical changes are here!"

we do use Azure Attested data in our application, but, at the best of my knowledge, we don't use certificate pinning. However we use Attested data to perform verification that the Azure VM is running properly on Azure platform:

   # Get the signature  
   curl --silent -H Metadata:True --noproxy "*" "http://169.254.169.254/metadata/attested/document?api-version=2019-04-30" | jq -r '.["signature"]' > signature  
   # Decode the signature  
   base64 -d signature > decodedsignature  
   # Get PKCS7 format  
   openssl pkcs7 -in decodedsignature -inform DER -out sign.pk7  
   # Get Public key out of pkc7  
   openssl pkcs7 -in decodedsignature -inform DER  -print_certs -out signer.pem  
   # Get the intermediate certificate  
   curl -s -o intermediate.cer "$(openssl x509 -in signer.pem -text -noout | grep " CA Issuers -" | awk -FURI: '{print $2}')"  
   openssl x509 -inform der -in intermediate.cer -out intermediate.pem  
   # Verify the contents  
   openssl smime -verify -in sign.pk7 -inform pem -noverify  

as shown in this page

In my opinion this shouldn't be affected by your changes, but I wanted to be sure I hadn't miss something. So can you please confirm it is ok?
Thank you in advance

Andrea Castello
Scientiamobile Inc.

Answer 1

Hello @Azure Partner ,

Thank you for reaching out to the Microsoft Q&A platform. Happy to answer your question.

Customers who explicitly specify a list of acceptable CAs (a practice known as “certificate pinning”) in Azure instance metadata service attested data are impacted. Hence you will not be impacted as you confirm that you have not pinned certs to any intermediate CA certs.

How do I know whether my applications are impacted?
If any client application has pinned to an Intermediate CA rather than the Baltimore CyberTrust Root, immediate action is required to prevent disruption in the services which rely on Azure Instance metadata service.

If you have an application that integrates with Azure services, or if you get your VM images from Azure marketplace, and you are unsure if it uses certificate pinning with Azure Instance Metadata Service Attested data, check with the application/image owner.

For more details, you can refer to this thread https://learn.microsoft.com/en-us/answers/questions/878907/azure-instance-metadata-service-attested-data-cert.html

****If you are satisfied with the answer, please "Accept as Answer" and Upvote, so that you can help others in the community looking for remediation for similar issues.****