Fix a few issues with maa.jwt.verifier.dotnet

[Greg Kostal (gkostal)]

Purpose

This PR fixes a couple issues with the maa-jwt-verifier.dotnet app:

• It's missing the latest AMD VCEK root CA (for Turin)
• It's failing validation of the UVM endorsement since the leaf cert has expired

Does this introduce a breaking change?

[ ] Yes
[x] No

Pull Request Type

What kind of change does this Pull Request introduce?

[x] Bugfix
[ ] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Documentation content changes
[ ] Other... Please describe:

How to Test

• Get the code

git clone https://github.com/Azure-Samples/microsoft-azure-attestation
cd microsoft-azure-attestation\maa.jwt.verifier.dotnet

• Test the code

dotnet run

What to Check

Verify that the final line in the console window is:

SUCCESS: JWT token passed all validation checks.

Other Information

[Copilot]

🟡 Changes recommended

Scope the expiration bypass so expired UVM signing certificates are not accepted indefinitely.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates the .NET JWT verifier for AMD Turin VCEK roots and expired UVM endorsement certificates.

Changes:

• Adds and registers the AMD Turin trusted root.
• Updates trusted AMD root definitions.
• Adds configurable leaf-expiration handling for UVM endorsements.
• The expiration bypass is too broad and requires a scoped or time-bounded policy.

File summaries

File	Summary
maa.jwt.verifier.dotnet/Utilities.cs	Adds configurable certificate leaf-expiration handling.
maa.jwt.verifier.dotnet/TrustedValues.cs	Adds and organizes AMD trusted root keys.
maa.jwt.verifier.dotnet/Program.cs	Enables expired-leaf handling for UVM validation; this currently bypasses lifetime checks too broadly.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Olga Kroshkina (olkroshk)]

I think this recommendation can be passed on because the sample does not recommend disabling leaf certificate expiration validation. The sample is to demonstrate how to validate a MAA-issued JWT.

Crypto libraries such as OpenSSL (https://docs.openssl.org/master/man3/X509_VERIFY_PARAM_set_flags/) already provide flags that allow consumers to configure validation behavior based on their specific requirements or for testing purposes. Adding this flag provides the same convenience.