القائمة
Skill helps user to remove checked-in certificates from source code in case of exposed secrets
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/aibot88/sec_skill_store --skill remediate-pfx-certificatesيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| type | skill |
| lifecycle | stable |
| inheritance | inheritable |
| name | remediate-pfx-certificates |
| description | Skill helps user to remove checked-in certificates from source code in case of exposed secrets |
| tier | standard |
| applyTo | **/*remediate*,**/*pfx*,**/*certificates* |
| currency | 2026-04-30T00:00:00.000Z |
| lastReviewed | 2026-04-30T00:00:00.000Z |
Look for exposed secrets in current repository. You may find tokens, connection string, certificates (pfx files). Remove the checked in certificate files from the repository and create a pull request with this change.
Why did I get this alert?
An Azure DevOps Git repository owned by your service has a checked-in certificate file (.pfx) that includes the certificate’s private key. You must act assuming this certificate has been compromised and must no longer be trusted by your service. This compromised certificate may be used by your service for one of many different purposes:
The security team cannot tell how your service is using the compromised certificate and was issued. You must investigate and determine the appropriate remediation steps for your service.
[!NOTE] For non-production resources, please move to NPE tenant. Refer to this documentation for more information.
How long do I have to remediate the action items?
Each alert represents a unique place where that certificate exists in a repo and has a thumbprint column that is a unique identifier for a certificate. Other columns in the alert contain important metadata about the certificate, like Issuer and Subject. Each certificate thumbprint may have many rows in that table since some certificates have been copied multiple times within a repo or across multiple repos. At this point, all certificates being flagged for service teams are present in the latest version of the default branch in at least one repo. Therefore, if you need the certificate content, you can start by looking at the repo and path information.
Note: This S360 KPI relies on Cloudmine's CodeAsData Kusto cluster, hence the latency to reflect the changes can take about a week (after team has mitigated the PFX file in source code, it can take about a week to automatically remove the action item).
There are three potential paths for you to follow:
The following applies to certificates used for Server TLS or Client Authentication. You need to rotate the cert immediately by following these steps:
Rotate the Certificate in Key Vault or dSMS:
Update Service with Rotated Certificate and Invalidate the Old Certificate: Update your service to use the rotated certificate, verify there is no usage of the old certificate, verify changes for your end-to-end scenario works, and deploy using SDP.
Revoke certificate: If you need OneCert to revoke your certificate, open an IcM Incident for the OneCert service’s Incident Manager team to revoke the certificate.
Delete Old PFX from Source: Remove the old PFX file from source. There is no need to purge commit history because the cert is already compromised.
The following applies to certificates used for Server TLS or Client Authentication. You must start using OneCert immediately by following these steps:
[!NOTE] See FAQ Question #6 if your team can confirm that the cert is being used for benign testing purposes with no production impact.
You must modify your service to use the new certificate. You must follow safe deployment practices to deploy necessary changes to your service to use the new certificate.
Invalidate the certificate: If the compromised certificate is used in production by your service, you must invalidate the certificate so that it is no longer accepted. The mechanism to invalidate the certificate will vary depending on what your service uses this certificate for and how the certificate is issued.
For general guidance on certificate handling, see here.
What is a PFX File?
A PFX (Personal Information Exchange) file is used to store cryptographic objects such as private keys, public keys, and certificates, along with their associated chain of trust. PFX files are typically password-protected for security purposes. They typically include:
How do I handle expired certs used for encryption of data at rest?
If your expired cert is used for encryption of data at rest, the encrypted data should be considered at risk of compromise. You need to re-encrypt your data with a new certificate.
Have more questions?
Ask ES Chat (AI Based Support Assistant) before reaching out to us. Engineering System (ES) Chat, our AI-based support assistant for Microsoft’s engineering systems. It provides personalized support leveraging documentation (EngHub, StackOverflow @ MS, etc) and Skills codified by many teams across 1ES to enhance productivity, streamline workflows, set up assets, handle onboarding, and diagnose problems.