Merge pull request #8105 from taskcluster/feat/azure-certs-2025-11-19

feat(w-m): Updating azure test certs

Author: lotas

changelog/OY0s9UhsRt67Y20uqjFJAQ.md

@@ -0,0 +1,3 @@
+audience: developers
+level: silent
+---

services/worker-manager/README.md

@@ -87,6 +87,10 @@ openssl x509 -noout -subject -in intermediate.pem
 openssl x509 -noout -fingerprint -in intermediate.pem
 # Verify the issuer for the intermediate certificate
 openssl x509 -noout -issuer -in intermediate.pem
+
+# Check expiry dates
+openssl x509 -noout -enddate -in signer.pem
+openssl x509 -noout -enddate -in intermediate.pem
 ```
 
 Last three lines would contain the values that should match `intermediateCertFingerprint`, `intermediateCertSubject`, `intermediateCertIssuer`, `intermediateCertPath` variables in `test/provider_azure_test.js`.

services/worker-manager/test/fixtures/azure_signature_good.json

@@ -1,7 +1,7 @@
 [
   {
-    "document":  "MIILmwYJKoZIhvcNAQcCoIILjDCCC4gCAQExDzANBgkqhkiG9w0BAQsFADCCATcGCSqGSIb3DQEHAaCCASgEggEkeyJsaWNlbnNlVHlwZSI6IiIsIm5vbmNlIjoiMjAyNTA4MjAtMDEwNDQwIiwicGxhbiI6eyJuYW1lIjoiIiwicHJvZHVjdCI6IiIsInB1Ymxpc2hlciI6IiJ9LCJza3UiOiIiLCJzdWJzY3JpcHRpb25JZCI6IjhhMjA1MTUyLWIyNWEtNDE3Zi1hNjc2LTgwNDY1NTM1YTZjOSIsInRpbWVTdGFtcCI6eyJjcmVhdGVkT24iOiIwOC8xOS8yNSAxOTowNDo0MCAtMDAwMCIsImV4cGlyZXNPbiI6IjA4LzIwLzI1IDAxOjA0OjQwIC0wMDAwIn0sInZtSWQiOiI5YjhlMjcyOC03YTM3LTRhOWUtYTVkMy1hOTQyZmQzMTFlMmQifaCCCJIwggiOMIIGdqADAgECAhMzAjIh1roCvPP5MXbkAAACMiHWMA0GCSqGSIb3DQEBDAUAMF0xCzAJBgNVBAYTAlVTMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xLjAsBgNVBAMTJU1pY3Jvc29mdCBBenVyZSBSU0EgVExTIElzc3VpbmcgQ0EgMDQwHhcNMjUwNTIyMjIyNjUwWhcNMjUxMTE4MjIyNjUwWjBpMQswCQYDVQQGEwJVUzELMAkGA1UECBMCV0ExEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEbMBkGA1UEAxMSbWV0YWRhdGEuYXp1cmUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0/Zr5yb9taUoj7g9GEqSnJlEHS6SRNnOlx5jwxpRcD6b5GGDllOkWgPxDzlnll2/aDcOxf9CU17eLX6UOtMICL5K0opYrWHTX8U9RzkpUTPr/Ceppf/Yloqb6WBjskzSHuwg/V1rFV7R8qc0ixKMMjmWNa+pxBWMDQhC133hA8PcwdHUNBR7esa6H8InJGdI97k4r2nlgJXi0rX8dnauFx0NUFp0HndandnVM3+IpKW/HZbUv3+Mg6HCvktve9HVTjUECZE2LmMpazhAoDuNy4tbUnYB6SZYXZJbXEQtZP/prgezv5qix8z1UiqvpP51Jb5WB24QxhpaF9MV4UyoaQIDAQABo4IEOTCCBDUwggGABgorBgEEAdZ5AgQCBIIBcASCAWwBagB3AN3cyjSV1+EWBeeVMvrHn/g9HFDf2wA6FBJ2Ciysu8gqAAABlvokbLQAAAQDAEgwRgIhAKVde+jpZj3ZR3fe+Gi+rfZppZlHKn1pmhEkk8gjqH9yAiEA+pZ90nJ9aCU3aWeRQAj8uE1ZAMt3F2eC21AuHL94pAQAdwB9WR4S4XgqexxhZ3xe/fjQh1wUoE6VnrkDL9kOjC55uAAAAZb6JGxpAAAEAwBIMEYCIQD4n4E6E7iAFhT1ZBRyuiLNuZCtMG1GM2sILB5TvCFJKwIhAI3S8LbTCb8Pk2WSt2N2WLm7KmpuE6fUmBx5qT+xsl5HAHYAGgT/SdBUHUCv9qDDv/HYxGcvTuzuI0BomGsXQC7ciX0AAAGW+iRtBwAABAMARzBFAiBhuFVHGEGRqoGkRJsxruQTCvNbjizpoY5qjWRyxTz/FwIhAIcYJ63aRzbvHgikJ5W1ybxnwR5sH4zdyn96gIlUzZMhMCcGCSsGAQQBgjcVCgQaMBgwCgYIKwYBBQUHAwIwCgYIKwYBBQUHAwEwPAYJKwYBBAGCNxUHBC8wLQYlKwYBBAGCNxUIh73XG4Hn60aCgZ0ujtAMh/DaHV2Cq+cwh+3xHwIBZAIBLTCBtAYIKwYBBQUHAQEEgacwgaQwcwYIKwYBBQUHMAKGZ2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwQXp1cmUlMjBSU0ElMjBUTFMlMjBJc3N1aW5nJTIwQ0ElMjAwNCUyMC0lMjB4c2lnbi5jcnQwLQYIKwYBBQUHMAGGIWh0dHA6Ly9vbmVvY3NwLm1pY3Jvc29mdC5jb20vb2NzcDAdBgNVHQ4EFgQUcO2//oGjh2pUUzYv7tHC+ZP1FZgwDgYDVR0PAQH/BAQDAgWgMEAGA1UdEQQ5MDeCIXNvdXRoY2VudHJhbHVzLm1ldGFkYXRhLmF6dXJlLmNvbYISbWV0YWRhdGEuYXp1cmUuY29tMAwGA1UdEwEB/wQCMAAwagYDVR0fBGMwYTBfoF2gW4ZZaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0JTIwQXp1cmUlMjBSU0ElMjBUTFMlMjBJc3N1aW5nJTIwQ0ElMjAwNC5jcmwwZgYDVR0gBF8wXTBRBgwrBgEEAYI3TIN9AQEwQTA/BggrBgEFBQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9zaXRvcnkuaHRtMAgGBmeBDAECAjAfBgNVHSMEGDAWgBQ7cNFT6XYlnWCoymYPxpuub1QWajAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDQYJKoZIhvcNAQEMBQADggIBALs2WJeozvioOIeIbBH4xG+nGl5KagaljrqgD+DdaniZ/s7O/TvzFwVcWLOnUWHwua74j+7HWdObp0nPjYAjIE+G8macz1CbYipn8pw+o145w2gZQDt/7pzS20Htq6NiYWaRwUSea+7KXQwoieofJgUoJ6Z7SfhKRXm0tTSCzUXHjt8SJEwLniSB+20JhcS+OEK8MLKM+vnpf733b72bwXfNystRNyo+7gMRYWTYRyJSzrBjZKmrJ79DCMN6cB6/E1Q2Sl5jX0CCN9An9gv4zXPX0y6VbWc5NUCsY9fo7Sd0QeWQHdsSXDHh7Wj+VWfwzPSOqHb1Gsqr4YqqJWUPkzefSJ0XIPnTs1qu4Q044r4cJzvm9yH64HaOtPY0p/5MSGKKKFwKhWuuEcz0dLIpkRVZXf4aG4SeNNpenCUZxTe5bwQlRTHTKckQyI0XqGG2aoGKT+tL2kuGbqK/e+WbPD22wcvFQaHfFnP5Zq9MblSRnq5PnZhuCVRgOF912y7HqYNEEFfKVWuhADy3XIxvfXrebd8cl+KvGbaVTdg0Gsg8lqa2JzxrBPzorKI5jlec5BZGcHgxp3UZFY5+RDy+OZJbkeApS+iGYtXRJ3byOznD0FivsbMr1enleC/70tdQRfTjZIDgLsTvG0SBdnj67J0LP9DU+5CV5YTulHe+HSiQMYIBnzCCAZsCAQEwdDBdMQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMS4wLAYDVQQDEyVNaWNyb3NvZnQgQXp1cmUgUlNBIFRMUyBJc3N1aW5nIENBIDA0AhMzAjIh1roCvPP5MXbkAAACMiHWMA0GCSqGSIb3DQEBCwUAMA0GCSqGSIb3DQEBAQUABIIBAM+wt3/LVzvEiLWnhKCyVxhkdeVIXTGw/6qSWXS9ZfAyGbi6/vW2lRXOsHyyiqGuoPreSH407FgbW5Wb9qAnn2vZrxNhufLfyVK0rf7u9n86/jq012VmhJL4ggYhst27CyoyiR6pOgUqdPYGrnTxBgw0VNJj4VhWJrMlQbNNZySRyimnW7KYWilF3LijN0d3USv1wXJQuFVHVndBStnmOOAhc7Vk7hEXaPJ7XZgUE+rzxWKcMzmMmLJPYP1pbdg0p5NzF7kUcOX1uCLzngtra18n4ce+0d9gBITQEiocV1SCG/SkrVY2EdprqyXFcFy9ne+SfsGVLPgwAyYtz6Eq0bs=",
-    "vmId": "9b8e2728-7a37-4a9e-a5d3-a942fd311e2d",
-    "notes": "exp:2025-11-18 Microsoft Azure RSA TLS Issuing CA 04"
+    "document":  "MIILkQYJKoZIhvcNAQcCoIILgjCCC34CAQExDzANBgkqhkiG9w0BAQsFADCCATcGCSqGSIb3DQEHAaCCASgEggEkeyJsaWNlbnNlVHlwZSI6IiIsIm5vbmNlIjoiMjAyNTExMTktMTg1MzMwIiwicGxhbiI6eyJuYW1lIjoiIiwicHJvZHVjdCI6IiIsInB1Ymxpc2hlciI6IiJ9LCJza3UiOiIiLCJzdWJzY3JpcHRpb25JZCI6IjhhMjA1MTUyLWIyNWEtNDE3Zi1hNjc2LTgwNDY1NTM1YTZjOSIsInRpbWVTdGFtcCI6eyJjcmVhdGVkT24iOiIxMS8xOS8yNSAxMjo1MzozMCAtMDAwMCIsImV4cGlyZXNPbiI6IjExLzE5LzI1IDE4OjUzOjMwIC0wMDAwIn0sInZtSWQiOiJkZGM4N2JkMi0zZWJiLTQzZGMtOTJhOS05MGIxMDRjZDk1MjcifaCCCIgwggiEMIIGbKADAgECAhMzAp8sOXATbsvEEVaVAAACnyw5MA0GCSqGSIb3DQEBDAUAMF0xCzAJBgNVBAYTAlVTMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xLjAsBgNVBAMTJU1pY3Jvc29mdCBBenVyZSBSU0EgVExTIElzc3VpbmcgQ0EgMDcwHhcNMjUxMDI1MTM1ODQ2WhcNMjYwNDIzMTM1ODQ2WjBpMQswCQYDVQQGEwJVUzELMAkGA1UECBMCV0ExEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEbMBkGA1UEAxMSbWV0YWRhdGEuYXp1cmUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwSnOdiqHEVKpZa/TVWGvGpoK9ghxIwFKJwmn8G3gxMd3Z57LDVuZzR8ldslsO+YF6LGeHAxzX5yuTrQscyIA1VdEmm/zA0UxLctbxY/ceXGjWAkVC5BXUPYlJkpzO5O6c+GlyIOmr76H68eaZnp0ZVO5HrdACGhY/rEuxRmVYCsXBTJoDnC7RJuyieJ7RPRAEX2XLfMVOevlxDyt0W0huCDk2tRqOa6WgD8jFv0Rtlkz8Xbeb6RnI8ZwI+A/kmd4Tz6x7C3Bwqy6up4tzNa0493e1LTgDvWUxDZYLZq35p8kpBzHNV9yhzMl0XEAoSkFF4pWzUDxVilm18M7LZCEbQIDAQABo4IELzCCBCswggF+BgorBgEEAdZ5AgQCBIIBbgSCAWoBaAB1AJaXZL9VWJet90OHaDcIQnfp8DrV9qTzNm5GpD8PyqnGAAABmhuzV2YAAAQDAEYwRAIgQHAEhlXHynFatNvB9Mz7Le/QpRey0EUU3624B8v+2XwCIBbATnVe2uMPXyUbZHLDC1yU6CtPpFlvIsUUIBhW9RT/AHcAZBHEbKQS7KeJHKICLgC8q08oB9QeNSer6v7VA8l9zfAAAAGaG7NXkQAABAMASDBGAiEAy/SfG7X9Je3E9anh1fV9cP1aXijvDugscgse9SW2utECIQCVLcqCFROWhw0g61TgONz/2HQhEJSVih2veop4gz1DjQB2AA5XlLzzrqk+MxssmQez95Dfm8I9cTIl3SGpJaxhxU4hAAABmhuzVxMAAAQDAEcwRQIhANgvKzB03W72YwAE5OxeYNXhluucbmzz/1lNhL2jPQMdAiADCWqpbwwkNowmC6SVHmXZALmIKw8Syl5DMu1hwujOEjAnBgkrBgEEAYI3FQoEGjAYMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMBMDwGCSsGAQQBgjcVBwQvMC0GJSsGAQQBgjcVCIe91xuB5+tGgoGdLo7QDIfw2h1dgqvnMIft8R8CAWQCAS0wgbQGCCsGAQUFBwEBBIGnMIGkMHMGCCsGAQUFBzAChmdodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01pY3Jvc29mdCUyMEF6dXJlJTIwUlNBJTIwVExTJTIwSXNzdWluZyUyMENBJTIwMDclMjAtJTIweHNpZ24uY3J0MC0GCCsGAQUFBzABhiFodHRwOi8vb25lb2NzcC5taWNyb3NvZnQuY29tL29jc3AwHQYDVR0OBBYEFA8AdGwyOfo+9k97SB/Gm5ACZvAPMA4GA1UdDwEB/wQEAwIFoDA4BgNVHREEMTAvghllYXN0dXMubWV0YWRhdGEuYXp1cmUuY29tghJtZXRhZGF0YS5henVyZS5jb20wDAYDVR0TAQH/BAIwADBqBgNVHR8EYzBhMF+gXaBbhllodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNyb3NvZnQlMjBBenVyZSUyMFJTQSUyMFRMUyUyMElzc3VpbmclMjBDQSUyMDA3LmNybDBmBgNVHSAEXzBdMFEGDCsGAQQBgjdMg30BATBBMD8GCCsGAQUFBwIBFjNodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL0RvY3MvUmVwb3NpdG9yeS5odG0wCAYGZ4EMAQICMB8GA1UdIwQYMBaAFM4VFjvqAqOma9rZK/3ljFK+elCoMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATANBgkqhkiG9w0BAQwFAAOCAgEAjx5q7M0e8vJoX+cwk3+jBZlqaaVOdfCWo1i2GSbwiX5OsBrq8AonBRjBv3YO8XJEeXV3nnN5K6aozlJWaTOIfy7ehhTyoFOuDukBZGRCyY+Bcassx2XzdlJ0wdRCD3BTEtGMchPEeErMKPM3sbnWpcMgTcHYBUQUBFTJKClNU3S8ime+NINrycuc7xQqhqvgbjRZqMfr/hSsOnZmOb2GuC47+8dHToJMmaFzM/baMtkRhEPaMULdR1VrUGXosvBFPeHewkdwy4w8kuEJSyp1Zm1i5BLdk+6PsaYeXFflOvLyZ2Ey0bjX4CxrAWxzvNlBdUwC3tixWxlAoSdLmBYrIFpqu0Z2fa962/1b7mJUYMN7YyOhUElwGiz64rwAx27Z0WugPpurPoHT63avXudlXEKFCZIovZr5Bj3UQbsHJ3jg2z23uFbtg8Rq+NcLBxQrM/uhugNz7LUdFy1pMGREUAQO5BrxFzN/zzesqOeY0CZPwxQGwAcR9QZ0A0b1Ijf+OFtdeplKQLAke8CPQmxmWSUOde6jTV4RS8Zg9DLy8eu4eF8h0o6mCE5wcLS8CqXR/L3oeSX1SQA87VyrIknQVuiwFmZQSuLHzsXSfeB15SWBUVr6h2mqzfZ8aacllSH4e8dH3JmtizFNFbHMSSRhEZG/IlGanGO14tc/v2DgpM0xggGfMIIBmwIBATB0MF0xCzAJBgNVBAYTAlVTMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xLjAsBgNVBAMTJU1pY3Jvc29mdCBBenVyZSBSU0EgVExTIElzc3VpbmcgQ0EgMDcCEzMCnyw5cBNuy8QRVpUAAAKfLDkwDQYJKoZIhvcNAQELBQAwDQYJKoZIhvcNAQEBBQAEggEASyTv/6XU2bsLzuNzOSxqY3aIgQcgawJk7x1MSodRfmNRhH1w6BfyqcHyGBcDPDNGbwS/xiYQiE+Rf0ocKP16iDGTKb0igAoOjibL3f7NRvMYXHaLuWE7CplWgKyDupcIK8cco7uM4yCTS4Hh0YaEJxMIcRM4149aZXO58izXaAQMJVWo2nG9EDBoG8RZH4rkeW9xFsjA+GgCHUWE6UVU+IF9VyLI3MFNS1S25UWkvEwdJ4QvcTnw9ywrqkZMl6IaYD3G0Z74tn1IbmobUoIvW+yfFHYf16/gl+z7Pn0OPzzO01ZR/xfH5dNsa/f6yddZAQIq9yezdMjcKx/ObneEgg==",
+    "vmId": "ddc87bd2-3ebb-43dc-92a9-90b104cd9527",
+    "notes": "exp:2026-08-25 Microsoft Azure RSA TLS Issuing CA 07"
   }
 ]

services/worker-manager/test/provider_azure_test.js

@@ -86,12 +86,12 @@ helper.secrets.mockSuite(testing.suiteName(), [], function(mock, skipping) {
   // with; to figure out which this is, print the certificate in
   // `registerWorker`.  It will be one of the certs on on
   // https://www.microsoft.com/pki/mscorp/cps/default.htm
-  const intermediateCertFingerprint = 'BE:68:D0:AD:AA:23:45:B4:8E:50:73:20:B6:95:D3:86:08:0E:5B:25';
-  const intermediateCertSubject = '/C=US,/O=Microsoft Corporation,/CN=Microsoft Azure RSA TLS Issuing CA 04';
+  const intermediateCertFingerprint = '33:82:51:70:58:A0:C2:02:28:D5:98:EE:75:01:B6:12:56:A7:64:42';
+  const intermediateCertSubject = '/C=US,/O=Microsoft Corporation,/CN=Microsoft Azure RSA TLS Issuing CA 07';
   const intermediateCertIssuer = '/C=US,/O=DigiCert Inc,/OU=www.digicert.com,/CN=DigiCert Global Root G2';
   const intermediateCertPath = path.resolve(
-    __dirname, '../src/providers/azure/azure-ca-certs/microsoft_azure_rsa_tls_issuing_ca_04_xsign.pem');
-  const intermediateCertUrl = 'http://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2004%20-%20xsign.crt';
+    __dirname, '../src/providers/azure/azure-ca-certs/microsoft_azure_rsa_tls_issuing_ca_07_xsign.pem');
+  const intermediateCertUrl = 'http://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20RSA%20TLS%20Issuing%20CA%2007%20-%20xsign.crt';
   const azureSignatures = JSON.parse(fs.readFileSync(path.resolve(__dirname, 'fixtures/azure_signature_good.json'), 'utf-8'));
   const allCertificates = loadCertificates();