Skip to main content

Azure Client Certificates Disabled

More Info:​

Client certificates allow the app to request a certificate for incoming requests. Only clients with a valid certificate will be able to reach the application. The TLS mutual authentication technique in enterprise environments ensures the authenticity of clients to the server.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS AZURE
  • Cloudanix Best Practice
  • HITRUST CSF
  • NIST CSF
  • PCI
  • SOC2

Triage and Remediation​

Remediation​

Using Console

To remediate the "Client Certificates Disabled" misconfiguration in Azure using the Azure console, follow these steps:

  1. Log in to the Azure portal (https://portal.azure.com/).

  2. Navigate to the App Service that needs to be remediated.

  3. Click on the "TLS/SSL settings" option from the left-hand menu.

  4. Scroll down to the "Client certificates" section and ensure that the "Client certificates required" option is set to "On".

  5. If the "Client certificates required" option is not set to "On", click on the "Edit" button.

  6. In the "Client certificates" section, select the "On" option and then click on the "Save" button.

  7. Once the changes are saved, the App Service will now require client certificates to be presented during SSL/TLS negotiation.

  8. Verify that the change has been successfully applied by testing the SSL/TLS connection to the App Service using a client certificate.

By following these steps, you have successfully remediated the "Client Certificates Disabled" misconfiguration in Azure using the Azure console.

Using CLI

To remediate the "Client Certificates Disabled" misconfiguration in Azure using Azure CLI, follow these steps:

  1. Open the Azure CLI terminal and login to your Azure account.

  2. Run the following command to list all the App Service Plans in your subscription:

    az appservice plan list

  3. Identify the App Service Plan that is affected by the misconfiguration.

  4. Run the following command to enable client certificates for the App Service Plan:

    az appservice plan update --name <app-service-plan-name> --resource-group <resource-group-name> --set clientCertEnabled=true

    Replace <app-service-plan-name> with the name of the App Service Plan and <resource-group-name> with the name of the resource group that contains the App Service Plan.

  5. Verify that client certificates are enabled for the App Service Plan by running the following command:

    az appservice plan show --name <app-service-plan-name> --resource-group <resource-group-name> --query clientCertEnabled

    This command should return true, indicating that client certificates are now enabled for the App Service Plan.

  6. Repeat the above steps for any other affected App Service Plans in your subscription.

By following these steps, you should be able to remediate the "Client Certificates Disabled" misconfiguration in Azure using Azure CLI.

Using Python

To remediate the "Client Certificates Disabled" misconfiguration in Azure using Python, you can use the Azure SDK for Python. Follow these steps:

  1. Install the Azure SDK for Python using pip:
pip install azure-mgmt-web
  1. Authenticate with Azure using a Service Principal:
from azure.common.credentials import ServicePrincipalCredentials
from azure.mgmt.web import WebSiteManagementClient

# Replace with your own values
subscription_id = 'your-subscription-id'
client_id = 'your-client-id'
secret = 'your-client-secret'
tenant = 'your-tenant-id'

# Create a Service Principal credential
credentials = ServicePrincipalCredentials(
    client_id=client_id,
    secret=secret,
    tenant=tenant
)

# Create a WebSiteManagementClient using the credentials
web_client = WebSiteManagementClient(credentials, subscription_id)
  1. Get the App Service Plan resource group and name:
# Replace with your own values
resource_group_name = 'your-resource-group-name'
app_service_plan_name = 'your-app-service-plan-name'

# Get the App Service Plan
app_service_plan = web_client.app_service_plans.get(resource_group_name, app_service_plan_name)
  1. Enable Client Certificates for the App Service Plan:
# Set the Client Certificates property to True
app_service_plan.client_cert_enabled = True

# Update the App Service Plan
web_client.app_service_plans.create_or_update(resource_group_name, app_service_plan_name, app_service_plan)

After running these steps, the "Client Certificates Disabled" misconfiguration should be remediated for the specified App Service Plan in Azure.

Using Terraform
resource "azurerm_windows_web_app" "APP_SERVICE_NAME" {
  name                = "APP_SERVICE_NAME"                  # replace with your App Service name
  resource_group_name = azurerm_resource_group.RG.name      # replace with your RG resource
  location            = azurerm_resource_group.RG.location  # replace with your RG resource
  service_plan_id     = azurerm_service_plan.ASP.id         # replace with your App Service plan

  https_only = true

  site_config {
    # This is the setting that enables client certificates (TLS mutual auth)
    client_cert_enabled = true

    # optional but commonly used hardening:
    minimum_tls_version = "1.2"
  }
}

Updating client_cert_enabled does not force replacement of the App Service; Terraform will perform an in‑place update.

Verification: terraform plan should show site_config.client_cert_enabled changing from false (or null) to true for the target App Service resource.

Additional Reading:​