Repair Azure Key Vault Certificate Rotation Drift

Repair Azure Key Vault Certificate Rotation Drift — EVIDENCE-LIMITED REVIEW

Scenario received

A cloud service keeps presenting an expired certificate after Key Vault creates a replacement.

Evidence inventory

• S1: vault certificate version history — partial extract described by the requester; original full source not provided here.
• S2: application certificate reference config — partial extract described by the requester; original full source not provided here.
• S3: rotation policy settings — NOT PROVIDED; required to validate dependent findings.
• S4: TLS handshake failures — NOT PROVIDED; required to validate dependent findings.

Case-specific checks

Map active versus referenced versions. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.
2.

Inspect refresh and cache delays. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.
3.

Validate expiration alert pathways. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.
4.

Plan staged certificate switchback. INCOMPLETE until matching source anchors can be examined; document the observable facts, counterexamples and decision gate.

Deliverables

Certificate drift chart. Create an evidence-linked section with observations, missing data, owner and next validation step.

Rotation repair sequence. Create an evidence-linked section with observations, missing data, owner and next validation step.

TLS regression checklist. Create an evidence-linked section with observations, missing data, owner and next validation step.

Acceptance gate

The repair retains a known good rollback and avoids revoking active credentials prematurely. Do not label this gate passed until supplied source records actually demonstrate it.

Verdict and next action

INCOMPLETE — evidence required. Request S3 and S4 from the authorized owner, reconcile them with S1 and S2, then repeat the four checks and log remaining conflicts. No production change, approval, communication, or test run is claimed.