From 656b6a469fd76e782ddca14f4ee48ec1953770e1 Mon Sep 17 00:00:00 2001 From: SergeyMenshykh Date: Tue, 4 Aug 2026 20:35:08 +0100 Subject: [PATCH 1/2] Python: Document x5t certificate thumbprint hashing in Copilot Studio agent The certificate thumbprint sent to MSAL is the X.509 `x5t` value, which MSAL and Microsoft Entra ID require to be computed with SHA-1. Add a comment explaining that this is an identifier, not a security primitive, and annotate the call so static analysis does not flag it. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d2b7d3e7-a125-4569-b976-a6534c1837ae --- .../agents/copilot_studio/copilot_studio_agent.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py b/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py index fe4f98c9dc99..30db6256cd4a 100644 --- a/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py +++ b/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py @@ -181,7 +181,10 @@ def _cert_thumbprint(cert_path: Path) -> str: pem_bytes = Path(cert_path).read_bytes() der_bytes = ssl.PEM_cert_to_DER_cert(pem_bytes.decode()) - return hashlib.sha1(der_bytes, usedforsecurity=False).hexdigest().upper() + # SHA-1 is not used here as a security primitive: it computes the X.509 certificate thumbprint + # (the `x5t` JWT header value), which MSAL and Microsoft Entra ID mandate to be SHA-1 for the + # `thumbprint` client credential. Hence the `usedforsecurity=False` flag. + return hashlib.sha1(der_bytes, usedforsecurity=False).hexdigest().upper() # CodeQL [SM02167] x5t thumbprint # endregion From 4eef2ef882f7d75b92ffd404ea7df94244684afe Mon Sep 17 00:00:00 2001 From: SergeyMenshykh <68852919+SergeyMenshykh@users.noreply.github.com> Date: Tue, 4 Aug 2026 20:40:45 +0100 Subject: [PATCH 2/2] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../agents/copilot_studio/copilot_studio_agent.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py b/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py index 30db6256cd4a..4c8da0fb21bd 100644 --- a/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py +++ b/python/semantic_kernel/agents/copilot_studio/copilot_studio_agent.py @@ -181,8 +181,8 @@ def _cert_thumbprint(cert_path: Path) -> str: pem_bytes = Path(cert_path).read_bytes() der_bytes = ssl.PEM_cert_to_DER_cert(pem_bytes.decode()) - # SHA-1 is not used here as a security primitive: it computes the X.509 certificate thumbprint - # (the `x5t` JWT header value), which MSAL and Microsoft Entra ID mandate to be SHA-1 for the + # SHA-1 is not used here as a security primitive; it is required to compute the X.509 certificate thumbprint + # (the `x5t` JWT header value), which MSAL and Microsoft Entra ID mandate to be a SHA-1 digest for the # `thumbprint` client credential. Hence the `usedforsecurity=False` flag. return hashlib.sha1(der_bytes, usedforsecurity=False).hexdigest().upper() # CodeQL [SM02167] x5t thumbprint