> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Azure audit keyvault certificates without sufficient renewal period remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the certificate auto-renewal issue in Azure using the Azure console, you can follow the below steps:

        1. Open the Azure portal and navigate to the specific certificate that needs to be remediated.
        2. Click on the certificate to open its properties.
        3. In the properties page, scroll down to the "Automation" section and click on the "Auto-renewal" option.
        4. In the "Auto-renewal" section, enable the "On" toggle button to turn on the auto-renewal feature.
        5. Specify the "Number of days before expiry" (e.g., 30 days) to trigger the auto-renewal process.
        6. Click on the "Save" button to save the changes.

        By following these steps, you have enabled the auto-renewal feature for the certificate and set the number of days before expiry to trigger the auto-renewal process. This ensures that the certificate is renewed before it expires, and the application or service using the certificate does not face any downtime due to an expired certificate.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the insufficient auto-renewal period for certificates in Azure using Azure CLI, follow these steps:

        1. Open Azure CLI on your machine.

        2. Log in to your Azure account using the command:

           `az login`

        3. Once you are logged in, select the subscription that contains the certificate you want to remediate using the command:

           `az account set --subscription <subscription_id>`

        4. Check the current auto-renewal period of the certificate using the command:

           `az keyvault certificate show --vault-name <vault_name> --name <certificate_name> --query 'attributes.autoRenewalDaysBeforeExpiry'`

           Replace `<vault_name>` with the name of the Key Vault where the certificate is stored and `<certificate_name>` with the name of the certificate.

        5. If the auto-renewal period is less than the desired period, update it using the command:

           `az keyvault certificate set-attributes --vault-name <vault_name> --name <certificate_name> --auto-renew-days <days>`

           Replace `<vault_name>` and `<certificate_name>` with the appropriate values, and set `<days>` to the desired number of days before expiry when the certificate should be auto-renewed.

        6. Verify that the auto-renewal period has been updated using the command:

           `az keyvault certificate show --vault-name <vault_name> --name <certificate_name> --query 'attributes.autoRenewalDaysBeforeExpiry'`

           This should return the updated auto-renewal period.

        7. Exit Azure CLI using the command:

           `exit`

        By following these steps, you can remediate the insufficient auto-renewal period for certificates in Azure using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the issue of insufficient auto-renewal period for certificates in Azure using Python, you can follow these steps:

        1. Import the necessary libraries:

        ```
        from azure.identity import DefaultAzureCredential
        from azure.mgmt.web import WebSiteManagementClient
        ```

        2. Authenticate to the Azure portal using the `DefaultAzureCredential` class:

        ```
        credential = DefaultAzureCredential()
        ```

        3. Initialize the `WebSiteManagementClient` class with the appropriate subscription ID and credential:

        ```
        subscription_id = 'your_subscription_id'
        web_client = WebSiteManagementClient(credential, subscription_id)
        ```

        4. Use the `web_client.certificates.get` method to retrieve the certificate details:

        ```
        certificate_name = 'your_certificate_name'
        certificate = web_client.certificates.get(resource_group_name='your_resource_group_name', name=certificate_name)
        ```

        5. Check the `expiration_time` property of the certificate to see if it is within the desired auto-renewal period. If not, use the `web_client.certificates.create_or_update` method to update the certificate with a new `expiration_time` value:

        ```
        if certificate.expiration_time < desired_auto_renewal_date:
            certificate.expiration_time = new_expiration_date
            web_client.certificates.create_or_update(resource_group_name='your_resource_group_name', name=certificate_name, certificate_envelope=certificate)
        ```

        Note: You will need to replace the placeholders (`your_subscription_id`, `your_resource_group_name`, `your_certificate_name`, `desired_auto_renewal_date`, and `new_expiration_date`) with your specific values.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "azurerm_key_vault" "EXISTING_VAULT" {
          name                = "EXISTING_VAULT_NAME"        # replace with your vault name
          resource_group_name = "EXISTING_RESOURCE_GROUP"    # replace with your resource group
          location            = "EXISTING_LOCATION"          # replace with your location

          tenant_id = "EXISTING_TENANT_ID"                   # replace with your tenant ID
          sku_name  = "standard"

          # ...other existing configuration...
        }

        resource "azurerm_key_vault_certificate" "CERTIFICATE_WITH_PROPER_RENEWAL" {
          name         = "CERTIFICATE_NAME"                  # replace with your certificate name
          key_vault_id = azurerm_key_vault.EXISTING_VAULT.id

          certificate_policy {
            issuer_parameters {
              name = "Self"                                  # or your issuer (e.g. "Unknown", "DigiCert", etc.)
            }

            key_properties {
              exportable = true
              key_size   = 2048
              key_type   = "RSA"
              reuse_key  = true
            }

            secret_properties {
              content_type = "application/x-pkcs12"
            }

            x509_certificate_properties {
              subject            = "CN=YOUR_SUBJECT"         # replace with your subject, e.g. CN=example.com
              validity_in_months = 12

              key_usage = [
                "digitalSignature",
                "keyEncipherment",
              ]
            }

            # This block enforces the auto-renewal period.
            lifetime_action {
              action {
                action_type = "AutoRenew"
              }

              trigger {
                days_before_expiry = 30                      # MUST be >= 15 to satisfy the check
              }
            }
          }
        }
        ```

        Changing the `certificate_policy.lifetime_action` (including `days_before_expiry`) typically forces replacement of the Key Vault certificate, which can cause a brief outage for any workload depending on that certificate until it starts using the new one.

        To verify, run `terraform plan` and ensure it shows an update (or replacement) to `azurerm_key_vault_certificate.CERTIFICATE_WITH_PROPER_RENEWAL` setting `certificate_policy.0.lifetime_action.0.trigger.0.days_before_expiry` to a value greater than or equal to `15`.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>