Skip to main content

Azure Audit Keyvault Certificates Without Right Key Size Fix

Triage and Remediation​

Remediation​

Using Console

To remediate this issue in Azure using Azure Console, follow the below steps:

  1. Login to Azure portal (https://portal.azure.com/)

  2. Navigate to the Azure Key Vault where the certificate is stored.

  3. Click on the certificate that needs to be updated.

  4. Click on the "Versions" tab and then click on the latest version of the certificate.

  5. Click on the "Download" button to download the certificate.

  6. Use OpenSSL or any other certificate management tool to update the certificate key size to the recommended key size.

  7. Once the certificate is updated, upload the updated certificate to Azure Key Vault.

  8. Navigate to the Azure Virtual Machine where the certificate is used.

  9. Click on the "Networking" tab and then click on the "Network interface" associated with the virtual machine.

  10. Click on the "IP configurations" tab and then click on the "Public IP address" associated with the virtual machine.

  11. Click on the "Configuration" tab and then click on the "SSL certificates" tab.

  12. Click on the "Add" button and then select the updated certificate from the Azure Key Vault.

  13. Click on the "Save" button to save the changes.

  14. Verify that the updated certificate is now being used by the virtual machine.

By following these steps, you can remediate the certificate key size issue in Azure using Azure Console.

Using CLI

To remediate the certificate key size misconfiguration in Azure using Azure CLI, you can follow the below steps:

Step 1: Log in to the Azure portal and open the Azure CLI.

Step 2: Run the following command to list all the certificates in your subscription:

az keyvault certificate list --vault-name <vault-name> --query [].kid

Note: Replace <vault-name> with the name of your key vault.

Step 3: Choose the certificate that has a key size less than the recommended key size.

Step 4: Run the following command to update the certificate with a new key size:

az keyvault certificate update --vault-name <vault-name> --name <certificate-name> --policy "$(az keyvault certificate show --vault-name <vault-name> --name <certificate-name> --query policy)" --size <new-key-size>

Note: Replace <vault-name> with the name of your key vault, <certificate-name> with the name of the certificate you want to update, and <new-key-size> with the recommended key size.

Step 5: Verify that the certificate has been updated successfully by running the following command:

az keyvault certificate show --vault-name <vault-name> --name <certificate-name> --query policy.key_props.key_size

Note: Replace <vault-name> with the name of your key vault and <certificate-name> with the name of the certificate you updated.

Step 6: Repeat the above steps for all the certificates that have a key size less than the recommended key size.

By following the above steps, you can remediate the certificate key size misconfiguration in Azure using Azure CLI.

Using Python

To remediate the issue of certificate key size being less than the recommended key size in Azure using Python, you can follow the below steps:

  1. Import the necessary libraries:
from azure.identity import DefaultAzureCredential
from azure.mgmt.web import WebSiteManagementClient
  1. Instantiate the WebSiteManagementClient class:
credential = DefaultAzureCredential()
subscription_id = 'your-subscription-id'
resource_group_name = 'your-resource-group-name'
webapp_name = 'your-webapp-name'

client = WebSiteManagementClient(credential, subscription_id)
  1. Get the current certificate properties:
certificate_name = 'your-certificate-name'
certificate = client.certificates.get(resource_group_name, certificate_name)
  1. Check if the key size is less than the recommended key size:
if certificate.key_size < 2048:
    certificate.key_size = 2048
    client.certificates.create_or_update(resource_group_name, certificate_name, certificate)
  1. Update the certificate key size if it is less than the recommended key size:
certificate.key_size = 2048
client.certificates.create_or_update(resource_group_name, certificate_name, certificate)

By following these steps, you can remediate the issue of certificate key size being less than the recommended key size in Azure using Python.

Using Terraform
resource "azurerm_key_vault_certificate" "CERTIFICATE_NAME" {
  name         = "CERTIFICATE_NAME"                # replace with your certificate name
  key_vault_id = azurerm_key_vault.KEY_VAULT_NAME.id  # replace KEY_VAULT_NAME with your key vault resource

  certificate_policy {
    issuer_parameters {
      name = "Self"  # or your certificate authority, e.g., "Unknown" / "DigiCert" etc.
    }

    key_properties {
      exportable = true
      key_type   = "RSA"
      key_size   = 2048  # minimum recommended key size; increase if your org requires larger
      reuse_key  = false
    }

    secret_properties {
      content_type = "application/x-pkcs12"
    }

    x509_certificate_properties {
      subject            = "CN=REPLACE_WITH_SUBJECT"   # e.g., CN=example.com
      validity_in_months = 12
      key_usage = [
        "digitalSignature",
        "keyEncipherment",
      ]
    }

    lifetime_action {
      action {
        action_type = "AutoRenew"
      }

      trigger {
        days_before_expiry = 30
      }
    }
  }
}

Updating key_size on an existing azurerm_key_vault_certificate forces replacement of the certificate (new key pair and cert are generated), which may cause an outage if relying services are not prepared for the new certificate; plan and coordinate rotation accordingly.

To verify, run terraform plan and ensure it shows a change on this certificate resource with key_size changing to 2048 (or higher) and that the resource will be replaced (-/+ in the plan).