Azure Introduction
Azure Pricing
Azure Threats
Certificate Transparency should be enabled
More Info:
Ensure that Certificate Transparency feature is enabled for all Azure Key Vault SSL/TLS certificates in order to adhere to best practices. Certificate Transparency (CT) is a new Internet standard that addresses the concerns about mis-issued certificates by making the Transport Layer Security (TLS) ecosystem publicly auditable.
Risk Level
Medium
Address
Security
Compliance Standards
CBP
Triage and Remediation
Remediation
To remediate the Certificate Transparency misconfiguration in Azure using Azure console, please follow the below steps:
- Login to Azure portal (https://portal.azure.com/)
- Navigate to the App Service for which you want to enable Certificate Transparency.
- Click on “TLS/SSL settings” under the “Settings” section.
- Scroll down to the “Certificate Transparency” section.
- Toggle the “Certificate Transparency” switch to “On” position.
- Click on “Save” to save the changes.
After following the above steps, Certificate Transparency will be enabled for the App Service in Azure.
To remediate the Certificate Transparency misconfiguration in Azure using Azure CLI, please follow the below steps:
-
Open the Azure CLI on your local machine or use the Azure Cloud Shell.
-
Run the following command to create a new resource group:
az group create --name <resource-group-name> --location <location>
Replace
<resource-group-name>
with a unique name for the resource group and<location>
with the location where you want to create the resource group. -
Run the following command to create a new web app:
az webapp create --name <app-name> --resource-group <resource-group-name> --plan <app-service-plan> --runtime "DOTNETCORE|3.1"
Replace
<app-name>
with a unique name for the web app,<resource-group-name>
with the name of the resource group you created in step 2,<app-service-plan>
with the name of the app service plan you want to use, and--runtime "DOTNETCORE|3.1"
with the runtime version you want to use. -
Run the following command to enable Certificate Transparency for the web app:
az webapp config set --name <app-name> --resource-group <resource-group-name> --ftps-state Disabled --http20 Enabled --min-tls-version 1.2 --tls-version-1-0 Disabled --tls-version-1-1 Disabled --tls-version-1-2 Enabled --tls-version-1-3 Enabled --use-32bit-worker-process false --certificate-transparency Enabled
Replace
<app-name>
with the name of the web app you created in step 3 and<resource-group-name>
with the name of the resource group you created in step 2. -
Verify that Certificate Transparency is enabled for the web app by running the following command:
az webapp config show --name <app-name> --resource-group <resource-group-name> --query certificateTransparency
Replace
<app-name>
with the name of the web app you created in step 3 and<resource-group-name>
with the name of the resource group you created in step 2.If the output of the command is
true
, then Certificate Transparency is enabled for the web app.
That’s it! You have successfully remediated the Certificate Transparency misconfiguration for an Azure web app using Azure CLI.
To remediate Certificate Transparency misconfiguration in Azure using Python, you can follow the below steps:
- First, you need to check if Certificate Transparency is enabled or not. You can use the Azure SDK for Python to check the status of Certificate Transparency. Here is the sample code to check the status:
from azure.mgmt.web import WebSiteManagementClient
from azure.common.credentials import ServicePrincipalCredentials
# Set up the credentials
subscription_id = 'your-subscription-id'
credentials = ServicePrincipalCredentials(
client_id='your-client-id',
secret='your-client-secret',
tenant='your-tenant-id'
)
# Set up the web client
web_client = WebSiteManagementClient(credentials, subscription_id)
# Get the web app
web_app = web_client.web_apps.get('your-resource-group', 'your-web-app')
# Check if Certificate Transparency is enabled
if web_app.certificate_transparency_enabled:
print('Certificate Transparency is enabled')
else:
print('Certificate Transparency is disabled')
- If Certificate Transparency is disabled, you need to enable it. You can use the same Azure SDK for Python to enable Certificate Transparency. Here is the sample code to enable it:
from azure.mgmt.web.models import SiteConfig
# Set up the site configuration
site_config = SiteConfig(
certificate_transparency_enabled=True
)
# Update the web app
web_client.web_apps.update_configuration('your-resource-group', 'your-web-app', site_config)
- After running the above code, Certificate Transparency will be enabled for your Azure web app.
Note: You need to replace the placeholders (your-subscription-id, your-client-id, your-client-secret, your-tenant-id, your-resource-group, your-web-app) with your actual values.