Azure Trusted Signing: hardcoded api-version=2022-06-15-preview is rejected by Azure (401 Unauthorized)

[nickddowns]

Problem

The AzureTrustedSigningService class hardcodes api-version=2022-06-15-preview in two places when constructing URLs for the Azure Trusted Signing API. Azure has deprecated this preview API version and now returns 401 Unauthorized for all requests using it, making the TRUSTEDSIGNING store type non-functional in jsign 7.1 through 7.4.

The error manifests as:

jsign: Unable to retrieve the certificate chain 'AccountName/ProfileName'
java.security.KeyStoreException: Unable to retrieve the certificate chain 'AccountName/ProfileName'
    at net.jsign.jca.AzureTrustedSigningService.getCertificateChain(AzureTrustedSigningService.java:109)
    ...
Caused by: java.io.IOException: HTTP Error 401 - Unauthorized
    (https://eus.codesigning.azure.net/codesigningaccounts/.../sign?api-version=2022-06-15-preview)

OAuth token acquisition succeeds (the credentials are valid), but the signing endpoint rejects the request because the API version is no longer supported. Testing with api-version=2024-02-05-preview confirms authentication passes and the endpoint responds normally.

Suggested fix

Make the API version configurable rather than hardcoded. This could be exposed as:

• A --param or --ksparams CLI option (e.g., --param api-version=2024-02-05-preview)
• Appended to the --keystore URL (e.g., --keystore "https://eus.codesigning.azure.net?api-version=2024-02-05-preview")
• Or at minimum, update the default to a currently supported version

Environment

• jsign versions tested: 7.1, 7.2, 7.4 (all affected)
• Azure Trusted Signing endpoint: eus.codesigning.azure.net
• Working API versions (tested via direct REST calls): 2024-02-05-preview
• Platform: Linux (AWS CodeBuild, Amazon Corretto 17)

[ebourg]

Thank you for reporting this issue. Changing the API version was suggested a few months ago (#332, #333) but the old version was still working and there was no urge to switch. Do you know if the version 2023-06-15-preview still works? I no longer have an Azure account, so I'll need some help to test the fix.

[nickddowns]

Thanks for the quick response!

I went back and tested the sign endpoint directly via REST calls against eus.codesigning.azure.net today, and the results were surprising:

API version	/sign POST result
2022-06-15-preview (current jsign default)	202 Accepted (works)
2023-06-15-preview	400 Bad Request (empty body)
2024-02-05-preview	400 Bad Request (not a supported version)
2024-06-15	400 Bad Request (empty body)

The api-supported-versions response header lists: 2022-06-15-preview, 2023-06-15-preview, 2024-06-15.

So it appears 2022-06-15-preview is actually still functional today — which contradicts what I was seeing when I filed this issue (consistent 401s from jsign in our CI pipeline). The newer versions (2023-06-15-preview and 2024-06-15) seem to require a different request body schema, returning 400 with the same payload that works on the old version.

I'm not sure what changed — it's possible Azure had a transient issue or regional inconsistency when we hit this. We've since moved to Azure's native signing tooling, so I can't easily reproduce the original jsign failure anymore.

That said, I still think the broader point stands: making the API version configurable would insulate jsign from future deprecations. Azure's api-supported-versions header shows they're already publishing a GA version (2024-06-15) alongside the previews, and the request schema appears to have changed between versions. A hardcoded version will eventually break again.

Happy to help test if you'd like to explore updating to the newer API schema or adding the version as a parameter. I still have an active Azure Trusted Signing account and can validate against it.

[ebourg]

The version can't really be parameter, because a different version most likely implies a different format of requests/responses.

Jsign should adopt the version 2024-06-15, the specification is there: https://github.com/Azure/azure-rest-api-specs/tree/main/specification/artifactsigning/data-plane/ArtifactSigning/stable/2024-06-15

[fgeib]

Since today, 2022-06-15-preview does not seem to work anymore on weu.codesigning.azure.net. I receive HTTP Error 401 - Unauthorized with jsign 7.4.
Are there plans to switch to 2024-06-15 soon?

[ebourg]

@fgeib Are you sure this isn't an authentication issue? The API should return an error 400 (bad request) rather than 401 (unauthorized) if the version is deprecated

[fgeib]

@ebourg Thanks, you are right. It seems to be an occasional authentication issue I need to investigate. I was mislead because 401 was mentioned in the topic and first post of this issue.

[ebourg]

Just to be sure, I checked the latest Microsoft ArtifactSigning Client 1.0.128, and it still defaults to the API version 2022-06-15-preview:

using Azure.Core;
using System;

#nullable disable
namespace Azure.CodeSigning;

public class CertificateProfileClientOptions : ClientOptions
{
  private const CertificateProfileClientOptions.ServiceVersion LatestVersion = CertificateProfileClientOptions.ServiceVersion.V2022_06_15_preview;

  internal string Version { get; }

  public CertificateProfileClientOptions(
    CertificateProfileClientOptions.ServiceVersion version = CertificateProfileClientOptions.ServiceVersion.V2022_06_15_preview)
  {
    if (version != CertificateProfileClientOptions.ServiceVersion.V2022_06_15_preview)
      throw new NotSupportedException();
    this.Version = "2022-06-15-preview";
  }

  public enum ServiceVersion
  {
    V2022_06_15_preview = 1,
  }
}

I think it's safer to keep Jsign aligned with the official Microsoft dlib used by signtool for now. I may reconsider if a newer version of the API has a significant advantage (e.g. faster).