spiffe/spire

Azure IMDS Plugin: Attestation Failures Due to Incomplete CA Pattern Coverage

Open

#6,952 opened on May 12, 2026

View on GitHub
 (1 comment) (0 reactions) (0 assignees)Go (631 forks)auto 404
help wantedpriority/backlog

Repository metrics

Stars
 (2,443 stars)
PR merge metrics
 (PR metrics pending)

Description

The Azure IMDS node attestor fails for VMs in certain Azure regions because it only validates one of three CA naming patterns Microsoft uses:

  • Pattern 1: Microsoft Azure RSA TLS Issuing CA XX (validated)
  • Pattern 2: Microsoft TLS G1 RSA CA OCSP XX (fails)
  • Pattern 3: Microsoft TLS G2 RSA CA OCSP XX (fails)

VMs with Pattern 2/3 certificates fail validation despite having legitimate Microsoft-issued certificates. This causes unpredictable attestation failures across Azure regions.

Root cause: The plugin validates intermediate CA names via regex instead of following Azure's official guidance (https://learn.microsoft.com/en-us/azure/virtual-machines/instance-metadata-service?tabs=linux#signature-validation-guidance) to validate the certificate Subject Alternative Name (SAN).

Additional issue: Missing Microsoft TLS RSA Root G2 root certificates (both self-signed and cross-signed versions), causing failures for 3-level certificate chains.

Contributor guide

Research direction
Inspect the Azure IMDS node attestor plugin code, identify regex patterns for CA names, and update to cover all three patterns. Also add missing root certificates.
Tech stack
go
Domain
backend
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GitAzure IMDS basic knowledge
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70