Skip to main content

Certificates have insufficient auto renewal period

More Info:​

In Microsoft Azure Key Vault, ensure that certificates have a sufficient auto-renewal period configured for security and compliance purposes. This period indicates the amount of time (number of days) before SSL certificate expiration, when the renewal process is automatically triggered.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • GDPR

Triage and Remediation​

Remediation​

Using Console

To remediate the certificate auto-renewal issue in Azure using the Azure console, you can follow the below steps:

  1. Open the Azure portal and navigate to the specific certificate that needs to be remediated.
  2. Click on the certificate to open its properties.
  3. In the properties page, scroll down to the "Automation" section and click on the "Auto-renewal" option.
  4. In the "Auto-renewal" section, enable the "On" toggle button to turn on the auto-renewal feature.
  5. Specify the "Number of days before expiry" (e.g., 30 days) to trigger the auto-renewal process.
  6. Click on the "Save" button to save the changes.

By following these steps, you have enabled the auto-renewal feature for the certificate and set the number of days before expiry to trigger the auto-renewal process. This ensures that the certificate is renewed before it expires, and the application or service using the certificate does not face any downtime due to an expired certificate.

Using CLI

To remediate the insufficient auto-renewal period for certificates in Azure using Azure CLI, follow these steps:

  1. Open Azure CLI on your machine.

  2. Log in to your Azure account using the command:

    az login

  3. Once you are logged in, select the subscription that contains the certificate you want to remediate using the command:

    az account set --subscription <subscription_id>

  4. Check the current auto-renewal period of the certificate using the command:

    az keyvault certificate show --vault-name <vault_name> --name <certificate_name> --query 'attributes.autoRenewalDaysBeforeExpiry'

    Replace <vault_name> with the name of the Key Vault where the certificate is stored and <certificate_name> with the name of the certificate.

  5. If the auto-renewal period is less than the desired period, update it using the command:

    az keyvault certificate set-attributes --vault-name <vault_name> --name <certificate_name> --auto-renew-days <days>

    Replace <vault_name> and <certificate_name> with the appropriate values, and set <days> to the desired number of days before expiry when the certificate should be auto-renewed.

  6. Verify that the auto-renewal period has been updated using the command:

    az keyvault certificate show --vault-name <vault_name> --name <certificate_name> --query 'attributes.autoRenewalDaysBeforeExpiry'

    This should return the updated auto-renewal period.

  7. Exit Azure CLI using the command:

    exit

By following these steps, you can remediate the insufficient auto-renewal period for certificates in Azure using Azure CLI.

Using Python

To remediate the issue of insufficient auto-renewal period for certificates in Azure using Python, you can follow these steps:

  1. Import the necessary libraries:
from azure.identity import DefaultAzureCredential
from azure.mgmt.web import WebSiteManagementClient
  1. Authenticate to the Azure portal using the DefaultAzureCredential class:
credential = DefaultAzureCredential()
  1. Initialize the WebSiteManagementClient class with the appropriate subscription ID and credential:
subscription_id = 'your_subscription_id'
web_client = WebSiteManagementClient(credential, subscription_id)
  1. Use the web_client.certificates.get method to retrieve the certificate details:
certificate_name = 'your_certificate_name'
certificate = web_client.certificates.get(resource_group_name='your_resource_group_name', name=certificate_name)
  1. Check the expiration_time property of the certificate to see if it is within the desired auto-renewal period. If not, use the web_client.certificates.create_or_update method to update the certificate with a new expiration_time value:
if certificate.expiration_time < desired_auto_renewal_date:
    certificate.expiration_time = new_expiration_date
    web_client.certificates.create_or_update(resource_group_name='your_resource_group_name', name=certificate_name, certificate_envelope=certificate)

Note: You will need to replace the placeholders (your_subscription_id, your_resource_group_name, your_certificate_name, desired_auto_renewal_date, and new_expiration_date) with your specific values.

Using Terraform
resource "azurerm_key_vault" "EXISTING_VAULT" {
  name                = "EXISTING_VAULT_NAME"        # replace with your vault name
  resource_group_name = "EXISTING_RESOURCE_GROUP"    # replace with your resource group
  location            = "EXISTING_LOCATION"          # replace with your location

  tenant_id = "EXISTING_TENANT_ID"                   # replace with your tenant ID
  sku_name  = "standard"

  # ...other existing configuration...
}

resource "azurerm_key_vault_certificate" "CERTIFICATE_WITH_PROPER_RENEWAL" {
  name         = "CERTIFICATE_NAME"                  # replace with your certificate name
  key_vault_id = azurerm_key_vault.EXISTING_VAULT.id

  certificate_policy {
    issuer_parameters {
      name = "Self"                                  # or your issuer (e.g. "Unknown", "DigiCert", etc.)
    }

    key_properties {
      exportable = true
      key_size   = 2048
      key_type   = "RSA"
      reuse_key  = true
    }

    secret_properties {
      content_type = "application/x-pkcs12"
    }

    x509_certificate_properties {
      subject            = "CN=YOUR_SUBJECT"         # replace with your subject, e.g. CN=example.com
      validity_in_months = 12

      key_usage = [
        "digitalSignature",
        "keyEncipherment",
      ]
    }

    # This block enforces the auto-renewal period.
    lifetime_action {
      action {
        action_type = "AutoRenew"
      }

      trigger {
        days_before_expiry = 30                      # MUST be >= 15 to satisfy the check
      }
    }
  }
}

Changing the certificate_policy.lifetime_action (including days_before_expiry) typically forces replacement of the Key Vault certificate, which can cause a brief outage for any workload depending on that certificate until it starts using the new one.

To verify, run terraform plan and ensure it shows an update (or replacement) to azurerm_key_vault_certificate.CERTIFICATE_WITH_PROPER_RENEWAL setting certificate_policy.0.lifetime_action.0.trigger.0.days_before_expiry to a value greater than or equal to 15.

Additional Reading:​