I'm trying to secure the communication between two on-premise legacy applications (one .NET and one Java) using client certificates. One application is exposed externally so I don't want to rely on access keys.

Is it more secure to have both applications retrieve a client certificate using Azure Key Vault using an access key, rather than install certificates into the machine certificate store?

Azure Key Vault makes it easier to replace certificates, but if the Azure Key Vault access key is compromised someone may be able to download the certificate.

  • My initial thought is that the machine certificate store may be easier to prevent certain classes of potential vulnerabilities. If you don't need to reach outside your local on-prem network, it becomes easier to control/monitor access to the reasources. – user52472 Mar 26 at 21:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.