Certificate Transparency should be enabled

More Info:

Ensure that Certificate Transparency feature is enabled for all Azure Key Vault SSL/TLS certificates in order to adhere to best practices. Certificate Transparency (CT) is a new Internet standard that addresses the concerns about mis-issued certificates by making the Transport Layer Security (TLS) ecosystem publicly auditable.

Risk Level

Medium

Address

Security

Compliance Standards

• Cloudanix Best Practice

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the Certificate Transparency misconfiguration in Azure using Azure console, please follow the below steps:

1. Login to Azure portal (https://portal.azure.com/)
2. Navigate to the App Service for which you want to enable Certificate Transparency.
3. Click on "TLS/SSL settings" under the "Settings" section.
4. Scroll down to the "Certificate Transparency" section.
5. Toggle the "Certificate Transparency" switch to "On" position.
6. Click on "Save" to save the changes.

After following the above steps, Certificate Transparency will be enabled for the App Service in Azure.

Using CLI

To remediate the Certificate Transparency misconfiguration in Azure using Azure CLI, please follow the below steps:

1. Open the Azure CLI on your local machine or use the Azure Cloud Shell.

2. Run the following command to create a new resource group:

   az group create --name <resource-group-name> --location <location>

   Replace <resource-group-name> with a unique name for the resource group and <location> with the location where you want to create the resource group.

3. Run the following command to create a new web app:

   az webapp create --name <app-name> --resource-group <resource-group-name> --plan <app-service-plan> --runtime "DOTNETCORE|3.1"

   Replace <app-name> with a unique name for the web app, <resource-group-name> with the name of the resource group you created in step 2, <app-service-plan> with the name of the app service plan you want to use, and --runtime "DOTNETCORE|3.1" with the runtime version you want to use.

4. Run the following command to enable Certificate Transparency for the web app:

   az webapp config set --name <app-name> --resource-group <resource-group-name> --ftps-state Disabled --http20 Enabled --min-tls-version 1.2 --tls-version-1-0 Disabled --tls-version-1-1 Disabled --tls-version-1-2 Enabled --tls-version-1-3 Enabled --use-32bit-worker-process false --certificate-transparency Enabled

   Replace <app-name> with the name of the web app you created in step 3 and <resource-group-name> with the name of the resource group you created in step 2.

5. Verify that Certificate Transparency is enabled for the web app by running the following command:

   az webapp config show --name <app-name> --resource-group <resource-group-name> --query certificateTransparency

   Replace <app-name> with the name of the web app you created in step 3 and <resource-group-name> with the name of the resource group you created in step 2.

   If the output of the command is true, then Certificate Transparency is enabled for the web app.

That's it! You have successfully remediated the Certificate Transparency misconfiguration for an Azure web app using Azure CLI.

Using Python

To remediate Certificate Transparency misconfiguration in Azure using Python, you can follow the below steps:

1. First, you need to check if Certificate Transparency is enabled or not. You can use the Azure SDK for Python to check the status of Certificate Transparency. Here is the sample code to check the status:

from azure.mgmt.web import WebSiteManagementClient
from azure.common.credentials import ServicePrincipalCredentials

# Set up the credentials
subscription_id = 'your-subscription-id'
credentials = ServicePrincipalCredentials(
    client_id='your-client-id',
    secret='your-client-secret',
    tenant='your-tenant-id'
)

# Set up the web client
web_client = WebSiteManagementClient(credentials, subscription_id)

# Get the web app
web_app = web_client.web_apps.get('your-resource-group', 'your-web-app')

# Check if Certificate Transparency is enabled
if web_app.certificate_transparency_enabled:
    print('Certificate Transparency is enabled')
else:
    print('Certificate Transparency is disabled')

2. If Certificate Transparency is disabled, you need to enable it. You can use the same Azure SDK for Python to enable Certificate Transparency. Here is the sample code to enable it:

from azure.mgmt.web.models import SiteConfig

# Set up the site configuration
site_config = SiteConfig(
    certificate_transparency_enabled=True
)

# Update the web app
web_client.web_apps.update_configuration('your-resource-group', 'your-web-app', site_config)

3. After running the above code, Certificate Transparency will be enabled for your Azure web app.

Note: You need to replace the placeholders (your-subscription-id, your-client-id, your-client-secret, your-tenant-id, your-resource-group, your-web-app) with your actual values.

Using Terraform

# There is currently no Azure or Terraform setting to enable/disable
# Certificate Transparency on an azurerm_key_vault_certificate.

# The azurerm provider’s resources:
#   - azurerm_key_vault
#   - azurerm_key_vault_certificate
#   - azurerm_key_vault_certificate_issuer
# do not expose any argument related to Certificate Transparency (CT),
# and Azure Key Vault itself does not provide a CT toggle on certificates.

# CT compliance must instead be handled by:
# - Using a public CA that logs certificates to CT logs (most modern CAs do this by default), and/or
# - Configuring CT at the CA / PKI layer (e.g., AD CS extensions), not in Key Vault.

# Example azurerm_key_vault_certificate (shown just to clarify there is no CT argument):

resource "azurerm_key_vault_certificate" "example" {
  name         = "EXAMPLE_CERT_NAME"          # replace with your certificate name
  key_vault_id = azurerm_key_vault.example.id

  certificate_policy {
    issuer_parameters {
      name = "Self"                           # or your chosen issuer, e.g. "Unknown", "DigiCert"
    }

    key_properties {
      exportable = true
      key_size   = 2048
      key_type   = "RSA"
      reuse_key  = true
    }

    secret_properties {
      content_type = "application/x-pkcs12"
    }

    x509_certificate_properties {
      subject            = "CN=example.com"   # replace with your subject
      validity_in_months = 12
    }
  }
}

This finding cannot be remediated on the azure-securityandidentity-keyvault-vault-certificate surface via Terraform because neither Azure Key Vault nor the azurerm provider expose any Certificate Transparency setting for certificates. To address CT requirements, configure CT at the certificate authority/PKI level (e.g., ensure your issuing CA logs to public CT logs) following your CA’s or AD CS’s console documentation.

For verification, terraform plan will show no changes related to Certificate Transparency, because no CT-related arguments exist in these resources.

Additional Reading:

• https://support.microsoft.com/en-us/help/4093260/introduction-of-ad-cs-certificate-transparency
• https://www.certificate-transparency.org/what-is-ct