A hazel-coppice API must load a client certificate each night for a partner call. What should replace a checked-in PFX on disk?
Select an answer to reveal the explanation.
Short Explanation
Ditch the PFX in the repo. Pull the client cert from Key Vault with the Certificate client (or the cert’s secret backing, as docs describe) so rotation does not mean hunting disks.
Full Explanation
Azure Key Vault treats certificates as first-class objects. Applications retrieve them with the Certificate client or, where documentation describes it, via the certificate’s secret backing—avoiding checked-in PFX files. Public CDN, Git, and ad-hoc plaintext settings are poor certificate distribution channels.