| type | skill |
| lifecycle | stable |
| inheritance | inheritable |
| name | remediate-pfx-certificates |
| description | Skill helps user to remove checked-in certificates from source code in case of exposed secrets |
| tier | standard |
| applyTo | **/*remediate*,**/*pfx*,**/*certificates* |
| currency | 2026-04-30T00:00:00.000Z |
| lastReviewed | 2026-04-30T00:00:00.000Z |
Look for exposed secrets in current repository. You may find tokens, connection string, certificates (pfx files). Remove the checked in certificate files from the repository and create a pull request with this change.
PFX (Personal Information Exchange) Found in Source Code
Why did I get this alert?
An Azure DevOps Git repository owned by your service has a checked-in certificate file (.pfx) that includes the certificate’s private key. You must act assuming this certificate has been compromised and must no longer be trusted by your service. This compromised certificate may be used by your service for one of many different purposes:
- Confidential client authentication for Entra applications
- Server TLS authentication
- Client TLS authentication
- Data encryption
The security team cannot tell how your service is using the compromised certificate and was issued. You must investigate and determine the appropriate remediation steps for your service.
[!NOTE]
For non-production resources, please move to NPE tenant. Refer to this documentation for more information.
How long do I have to remediate the action items?
- This is part of Security Sprint Wave 1 – ES 8. You must start working on this issue immediately if it is a live secret and for the rest you must complete it by the end of the sprint 7/21. Follow Safe Deployment and test practices to remediate the issue.
Identify Impacted Services, Certificates, and PFX Files
Each alert represents a unique place where that certificate exists in a repo and has a thumbprint column that is a unique identifier for a certificate. Other columns in the alert contain important metadata about the certificate, like Issuer and Subject.
Each certificate thumbprint may have many rows in that table since some certificates have been copied multiple times within a repo or across multiple repos.
At this point, all certificates being flagged for service teams are present in the latest version of the default branch in at least one repo. Therefore, if you need the certificate content, you can start by looking at the repo and path information.
Key Terms in this document
- Invalidating the certificate means updating your code or configuration to no longer trust the certificate.
- Revoking the certificate means contacting the certificate authority (CA) to add the certificate's serial number to a revocation list.
Remediation Steps
Note: This S360 KPI relies on Cloudmine's CodeAsData Kusto cluster, hence the latency to reflect the changes can take about a week (after team has mitigated the PFX file in source code, it can take about a week to automatically remove the action item).
