services / Azure / Key Vault certificate issuer

A certificate issuer (certificatecas) is a data-plane object in a Key Vault that stores the configuration and CA account credentials used to enroll and renew certificates through an external certificate authority (e.g. DigiCert, GlobalSign).

The issuer holds CA account credentials (account ID and API key/password) and controls how trusted certificates are minted for dependent services; it lives in the CRITICAL-sensitivity Key Vault data plane.

Microsoft.​KeyVault/​Vaults/​certificatecas/​delete

Deleting the certificate issuer removes the data-plane object the vault uses to enroll/renew certificates, destroying stored issuer configuration/credentials and disrupting automated certificate issuance and renewal.

Risks

1. Data destruction (CRITICAL)
2. Denial-of-service (HIGH)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links