Skip to main content

Auto Renewal should be enabled for SSL Certificates

More Info:​

Microsoft Azure Key Vault service can renew your SSL certificates automatically in order to prevent any application or service outage, credential leak, or process violation that can disrupts your business.

Risk Level​

High

Address​

Security

Compliance Standards​

  • GDPR

Triage and Remediation​

Remediation​

Using Console

Sure, here are the steps to remediate the SSL certificate auto-renewal misconfiguration in Azure using the Azure console:

  1. Log in to the Azure portal (https://portal.azure.com/).
  2. Navigate to the "App Services" section.
  3. Select the app service for which you want to enable SSL certificate auto-renewal.
  4. In the left-hand menu, click on "TLS/SSL settings".
  5. Under the "Certificates" tab, select the SSL certificate for which you want to enable auto-renewal.
  6. Click on the "Renew" button.
  7. In the "Renewal settings" section, enable the "Auto-renew" option.
  8. Set the "Days before expiration" value to a number of days before the certificate expires when you want to start the renewal process.
  9. Click on the "Save" button to apply the changes.

That's it! The SSL certificate for your app service will now be automatically renewed before it expires.

Using CLI

To remediate the misconfiguration of SSL certificate auto-renewal for AZURE using AZURE CLI, follow these steps:

  1. Open the AZURE CLI on your local machine or use the Cloud Shell in the Azure Portal.

  2. Login to your Azure account using the command az login.

  3. Once you are logged in, set the subscription context where the SSL certificate is located using the command az account set --subscription <subscription_id>.

  4. Check the current status of the SSL certificate auto-renewal using the command az network application-gateway ssl-cert show --resource-group <resource_group_name> --gateway-name <application_gateway_name> --name <ssl_certificate_name> --query 'sslState'.

  5. If the output of the above command shows that the SSL certificate auto-renewal is not enabled, then enable it using the command az network application-gateway ssl-cert update --resource-group <resource_group_name> --gateway-name <application_gateway_name> --name <ssl_certificate_name> --set sslState=AutoRenew.

  6. Verify that the SSL certificate auto-renewal is enabled using the command az network application-gateway ssl-cert show --resource-group <resource_group_name> --gateway-name <application_gateway_name> --name <ssl_certificate_name> --query 'sslState'.

  7. Once you have verified that the SSL certificate auto-renewal is enabled, you can exit the Azure CLI by typing exit.

By following these steps, you can remediate the misconfiguration of SSL certificate auto-renewal for AZURE using AZURE CLI.

Using Python

To remediate the misconfiguration of enabling auto-renewal for SSL certificates in Azure using Python, follow the steps below:

Step 1: Install the Azure SDK for Python using the following command:

pip install azure-mgmt-web

Step 2: Authenticate with Azure using the Azure CLI or by setting the environment variables for authentication.

Step 3: Use the following Python code to enable auto-renewal for SSL certificates in Azure:

from azure.mgmt.web import WebSiteManagementClient
from azure.common.credentials import UserPassCredentials

# Replace the values with your Azure subscription ID, resource group name, and certificate name
subscription_id = 'your-subscription-id'
resource_group_name = 'your-resource-group-name'
certificate_name = 'your-certificate-name'

# Replace the values with your Azure credentials
credentials = UserPassCredentials('username', 'password')

# Create a WebSiteManagementClient object
client = WebSiteManagementClient(credentials, subscription_id)

# Get the certificate details
certificate = client.certificates.get(resource_group_name, certificate_name)

# Enable auto-renewal for the certificate
certificate.auto_renew = True

# Update the certificate
client.certificates.create_or_update(resource_group_name, certificate_name, certificate)

This code will enable auto-renewal for the specified SSL certificate in Azure.

Using Terraform
resource "azurerm_key_vault_certificate" "SSL_CERTIFICATE" {
  name         = "SSL_CERTIFICATE_NAME"          # replace with your certificate name
  key_vault_id = azurerm_key_vault.KEY_VAULT.id # or set to an existing Key Vault ID

  certificate_policy {
    issuer_parameters {
      name = "IssuerName" # e.g. "Self" or your integrated CA issuer name
    }

    key_properties {
      exportable = true
      key_size   = 2048
      key_type   = "RSA"
      reuse_key  = true
    }

    secret_properties {
      content_type = "application/x-pkcs12"
    }

    x509_certificate_properties {
      subject            = "CN=YOUR_CERT_SUBJECT" # e.g. "CN=example.com"
      validity_in_months = 12

      subject_alternative_names {
        dns_names = [
          "DNS_NAME_1",
          "DNS_NAME_2",
        ]
      }

      key_usage = [
        "digitalSignature",
        "keyEncipherment",
      ]
    }

    # Enable auto‑renewal: Key Vault will automatically renew the certificate
    # when it reaches the specified lifetime percentage or days before expiry.
    lifetime_action {
      action {
        action_type = "AutoRenew"
      }

      # Use one of the following triggers (only one may be set at a time):

      # Trigger by percentage of lifetime remaining (e.g. renew when 80% of lifetime has passed)
      # lifetime_percentage = 80

      # OR trigger by days before expiry (e.g. renew 30 days before expiration)
      days_before_expiry = 30
    }
  }
}

Changing the certificate_policy (including lifetime_action) forces replacement of azurerm_key_vault_certificate.SSL_CERTIFICATE, which creates a new certificate version and can impact consumers if they are pinned to a specific version.

For verification, terraform plan should show an update to azurerm_key_vault_certificate.SSL_CERTIFICATE adding or modifying the lifetime_action block with action_type = "AutoRenew" and the chosen trigger (days_before_expiry or lifetime_percentage).

Additional Reading:​