[SDL] Validate Key Vault's secrets certificate (#407)

loic-sharma · web-flow · commit 3914075b4c05 · 2018-04-23T10:27:42.000-07:00
Part of https://github.com/NuGet/Engineering/issues/1379 See https://devdiv.visualstudio.com/DevDiv/_workitems/edit/594980
diff --git a/src/PackageHash/Settings/dev.json b/src/PackageHash/Settings/dev.json
@@ -18,7 +18,7 @@
   "KeyVault_VaultName": "#{Deployment.Azure.KeyVault.VaultName}",
   "KeyVault_ClientId": "#{Deployment.Azure.KeyVault.ClientId}",
   "KeyVault_CertificateThumbprint": "#{Deployment.Azure.KeyVault.CertificateThumbprint}",
-  "KeyVault_ValidateCertificate": false,
+  "KeyVault_ValidateCertificate": true,
   "KeyVault_StoreName": "My",
   "KeyVault_StoreLocation": "LocalMachine"
 }
diff --git a/src/PackageHash/Settings/int.json b/src/PackageHash/Settings/int.json
@@ -18,7 +18,7 @@
   "KeyVault_VaultName": "#{Deployment.Azure.KeyVault.VaultName}",
   "KeyVault_ClientId": "#{Deployment.Azure.KeyVault.ClientId}",
   "KeyVault_CertificateThumbprint": "#{Deployment.Azure.KeyVault.CertificateThumbprint}",
-  "KeyVault_ValidateCertificate": false,
+  "KeyVault_ValidateCertificate": true,
   "KeyVault_StoreName": "My",
   "KeyVault_StoreLocation": "LocalMachine"
 }
diff --git a/src/PackageHash/Settings/prod.json b/src/PackageHash/Settings/prod.json
@@ -18,7 +18,7 @@
   "KeyVault_VaultName": "#{Deployment.Azure.KeyVault.VaultName}",
   "KeyVault_ClientId": "#{Deployment.Azure.KeyVault.ClientId}",
   "KeyVault_CertificateThumbprint": "#{Deployment.Azure.KeyVault.CertificateThumbprint}",
-  "KeyVault_ValidateCertificate": false,
+  "KeyVault_ValidateCertificate": true,
   "KeyVault_StoreName": "My",
   "KeyVault_StoreLocation": "LocalMachine"
 }
diff --git a/src/Validation.Callback.Vcs/Web.config b/src/Validation.Callback.Vcs/Web.config
@@ -13,7 +13,7 @@
     <add key="KeyVault:CertificateThumbprint" value="#{Deployment.Azure.KeyVault.CertificateThumbprint}" />
     <add key="KeyVault:StoreName" value="My" />
     <add key="KeyVault:StoreLocation" value="CurrentUser" />
-    <add key="KeyVault:ValidateCertificate" value="false" />
+    <add key="KeyVault:ValidateCertificate" value="true" />
   </appSettings>
   <!--
     For a description of web.config changes see http://go.microsoft.com/fwlink/?LinkId=235367.
diff --git a/src/Validation.PackageSigning.RevalidateCertificate/Settings/dev.json b/src/Validation.PackageSigning.RevalidateCertificate/Settings/dev.json
@@ -21,7 +21,7 @@
   "KeyVault_VaultName": "#{Deployment.Azure.KeyVault.VaultName}",
   "KeyVault_ClientId": "#{Deployment.Azure.KeyVault.ClientId}",
   "KeyVault_CertificateThumbprint": "#{Deployment.Azure.KeyVault.CertificateThumbprint}",
-  "KeyVault_ValidateCertificate": false,
+  "KeyVault_ValidateCertificate": true,
   "KeyVault_StoreName": "My",
   "KeyVault_StoreLocation": "LocalMachine"
 }
diff --git a/src/Validation.PackageSigning.RevalidateCertificate/Settings/int.json b/src/Validation.PackageSigning.RevalidateCertificate/Settings/int.json
@@ -21,7 +21,7 @@
   "KeyVault_VaultName": "#{Deployment.Azure.KeyVault.VaultName}",
   "KeyVault_ClientId": "#{Deployment.Azure.KeyVault.ClientId}",
   "KeyVault_CertificateThumbprint": "#{Deployment.Azure.KeyVault.CertificateThumbprint}",
-  "KeyVault_ValidateCertificate": false,
+  "KeyVault_ValidateCertificate": true,
   "KeyVault_StoreName": "My",
   "KeyVault_StoreLocation": "LocalMachine"
 }
diff --git a/src/Validation.PackageSigning.RevalidateCertificate/Settings/prod.json b/src/Validation.PackageSigning.RevalidateCertificate/Settings/prod.json
@@ -21,7 +21,7 @@
   "KeyVault_VaultName": "#{Deployment.Azure.KeyVault.VaultName}",
   "KeyVault_ClientId": "#{Deployment.Azure.KeyVault.ClientId}",
   "KeyVault_CertificateThumbprint": "#{Deployment.Azure.KeyVault.CertificateThumbprint}",
-  "KeyVault_ValidateCertificate": false,
+  "KeyVault_ValidateCertificate": true,
   "KeyVault_StoreName": "My",
   "KeyVault_StoreLocation": "LocalMachine"
 }

Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,7 @@`
`18`	`18`	`"KeyVault_VaultName": "#{Deployment.Azure.KeyVault.VaultName}",`
`19`	`19`	`"KeyVault_ClientId": "#{Deployment.Azure.KeyVault.ClientId}",`
`20`	`20`	`"KeyVault_CertificateThumbprint": "#{Deployment.Azure.KeyVault.CertificateThumbprint}",`
`21`		`- "KeyVault_ValidateCertificate": false,`
	`21`	`+ "KeyVault_ValidateCertificate": true,`
`22`	`22`	`"KeyVault_StoreName": "My",`
`23`	`23`	`"KeyVault_StoreLocation": "LocalMachine"`
`24`	`24`	`}`
Original file line number	Diff line number	Diff line change
`@@ -21,7 +21,7 @@`
`21`	`21`	`"KeyVault_VaultName": "#{Deployment.Azure.KeyVault.VaultName}",`
`22`	`22`	`"KeyVault_ClientId": "#{Deployment.Azure.KeyVault.ClientId}",`
`23`	`23`	`"KeyVault_CertificateThumbprint": "#{Deployment.Azure.KeyVault.CertificateThumbprint}",`
`24`		`- "KeyVault_ValidateCertificate": false,`
	`24`	`+ "KeyVault_ValidateCertificate": true,`
`25`	`25`	`"KeyVault_StoreName": "My",`
`26`	`26`	`"KeyVault_StoreLocation": "LocalMachine"`
`27`	`27`	`}`