> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Client Certificates Disabled

### More Info:

Client certificates allow the app to request a certificate for incoming requests. Only clients with a valid certificate will be able to reach the application. The TLS mutual authentication technique in enterprise environments ensures the authenticity of clients to the server.

### Risk Level

Medium

### Address

Security

### Compliance Standards

CISAZURE, CBP, HITRUST, SOC2, NISTCSF, PCIDSS

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the "Client Certificates Disabled" misconfiguration in Azure using the Azure console, follow these steps:

        1. Log in to the Azure portal ([https://portal.azure.com/](https://portal.azure.com/)).

        2. Navigate to the App Service that needs to be remediated.

        3. Click on the "TLS/SSL settings" option from the left-hand menu.

        4. Scroll down to the "Client certificates" section and ensure that the "Client certificates required" option is set to "On".

        5. If the "Client certificates required" option is not set to "On", click on the "Edit" button.

        6. In the "Client certificates" section, select the "On" option and then click on the "Save" button.

        7. Once the changes are saved, the App Service will now require client certificates to be presented during SSL/TLS negotiation.

        8. Verify that the change has been successfully applied by testing the SSL/TLS connection to the App Service using a client certificate.

        By following these steps, you have successfully remediated the "Client Certificates Disabled" misconfiguration in Azure using the Azure console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the "Client Certificates Disabled" misconfiguration in Azure using Azure CLI, follow these steps:

        1. Open the Azure CLI terminal and login to your Azure account.

        2. Run the following command to list all the App Service Plans in your subscription:

           ```
           az appservice plan list
           ```

        3. Identify the App Service Plan that is affected by the misconfiguration.

        4. Run the following command to enable client certificates for the App Service Plan:

           ```
           az appservice plan update --name <app-service-plan-name> --resource-group <resource-group-name> --set clientCertEnabled=true
           ```

           Replace `<app-service-plan-name>` with the name of the App Service Plan and `<resource-group-name>` with the name of the resource group that contains the App Service Plan.

        5. Verify that client certificates are enabled for the App Service Plan by running the following command:

           ```
           az appservice plan show --name <app-service-plan-name> --resource-group <resource-group-name> --query clientCertEnabled
           ```

           This command should return `true`, indicating that client certificates are now enabled for the App Service Plan.

        6. Repeat the above steps for any other affected App Service Plans in your subscription.

        By following these steps, you should be able to remediate the "Client Certificates Disabled" misconfiguration in Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the "Client Certificates Disabled" misconfiguration in Azure using Python, you can use the Azure SDK for Python. Follow these steps:

        1. Install the Azure SDK for Python using pip:

        ```python theme={null}
        pip install azure-mgmt-web
        ```

        2. Authenticate with Azure using a Service Principal:

        ```python theme={null}
        from azure.common.credentials import ServicePrincipalCredentials
        from azure.mgmt.web import WebSiteManagementClient

        # Replace with your own values
        subscription_id = 'your-subscription-id'
        client_id = 'your-client-id'
        secret = 'your-client-secret'
        tenant = 'your-tenant-id'

        # Create a Service Principal credential
        credentials = ServicePrincipalCredentials(
            client_id=client_id,
            secret=secret,
            tenant=tenant
        )

        # Create a WebSiteManagementClient using the credentials
        web_client = WebSiteManagementClient(credentials, subscription_id)
        ```

        3. Get the App Service Plan resource group and name:

        ```python theme={null}
        # Replace with your own values
        resource_group_name = 'your-resource-group-name'
        app_service_plan_name = 'your-app-service-plan-name'

        # Get the App Service Plan
        app_service_plan = web_client.app_service_plans.get(resource_group_name, app_service_plan_name)
        ```

        4. Enable Client Certificates for the App Service Plan:

        ```python theme={null}
        # Set the Client Certificates property to True
        app_service_plan.client_cert_enabled = True

        # Update the App Service Plan
        web_client.app_service_plans.create_or_update(resource_group_name, app_service_plan_name, app_service_plan)
        ```

        After running these steps, the "Client Certificates Disabled" misconfiguration should be remediated for the specified App Service Plan in Azure.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.microsoft.com/bs-latn-ba/azure/app-service/app-service-web-configure-tls-mutual-auth](https://docs.microsoft.com/bs-latn-ba/azure/app-service/app-service-web-configure-tls-mutual-auth)