Certificate Transparency should be enabled

More Info:

Ensure that Certificate Transparency feature is enabled for all Azure Key Vault SSL/TLS certificates in order to adhere to best practices. Certificate Transparency (CT) is a new Internet standard that addresses the concerns about mis-issued certificates by making the Transport Layer Security (TLS) ecosystem publicly auditable.

Risk Level

Medium

Address

Security

Compliance Standards

CBP

Triage and Remediation

Remediation

Using Console

Using CLI

To remediate the Certificate Transparency misconfiguration in Azure using Azure CLI, please follow the below steps:

Open the Azure CLI on your local machine or use the Azure Cloud Shell.
Run the following command to create a new resource group:
```
az group create --name <resource-group-name> --location <location>
```
Replace <resource-group-name> with a unique name for the resource group and <location> with the location where you want to create the resource group.
Run the following command to create a new web app:
```
az webapp create --name <app-name> --resource-group <resource-group-name> --plan <app-service-plan> --runtime "DOTNETCORE|3.1"
```
Replace <app-name> with a unique name for the web app, <resource-group-name> with the name of the resource group you created in step 2, <app-service-plan> with the name of the app service plan you want to use, and --runtime "DOTNETCORE|3.1" with the runtime version you want to use.

Run the following command to enable Certificate Transparency for the web app:

az webapp config set --name <app-name> --resource-group <resource-group-name> --ftps-state Disabled --http20 Enabled --min-tls-version 1.2 --tls-version-1-0 Disabled --tls-version-1-1 Disabled --tls-version-1-2 Enabled --tls-version-1-3 Enabled --use-32bit-worker-process false --certificate-transparency Enabled

Replace <app-name> with the name of the web app you created in step 3 and <resource-group-name> with the name of the resource group you created in step 2.

Verify that Certificate Transparency is enabled for the web app by running the following command:
```
az webapp config show --name <app-name> --resource-group <resource-group-name> --query certificateTransparency
```
Replace <app-name> with the name of the web app you created in step 3 and <resource-group-name> with the name of the resource group you created in step 2. If the output of the command is true, then Certificate Transparency is enabled for the web app.

That’s it! You have successfully remediated the Certificate Transparency misconfiguration for an Azure web app using Azure CLI.

Using Python

To remediate Certificate Transparency misconfiguration in Azure using Python, you can follow the below steps:

First, you need to check if Certificate Transparency is enabled or not. You can use the Azure SDK for Python to check the status of Certificate Transparency. Here is the sample code to check the status:

from azure.mgmt.web import WebSiteManagementClient
from azure.common.credentials import ServicePrincipalCredentials

# Set up the credentials
subscription_id = 'your-subscription-id'
credentials = ServicePrincipalCredentials(
    client_id='your-client-id',
    secret='your-client-secret',
    tenant='your-tenant-id'
)

# Set up the web client
web_client = WebSiteManagementClient(credentials, subscription_id)

# Get the web app
web_app = web_client.web_apps.get('your-resource-group', 'your-web-app')

# Check if Certificate Transparency is enabled
if web_app.certificate_transparency_enabled:
    print('Certificate Transparency is enabled')
else:
    print('Certificate Transparency is disabled')

If Certificate Transparency is disabled, you need to enable it. You can use the same Azure SDK for Python to enable Certificate Transparency. Here is the sample code to enable it:

from azure.mgmt.web.models import SiteConfig

# Set up the site configuration
site_config = SiteConfig(
    certificate_transparency_enabled=True
)

# Update the web app
web_client.web_apps.update_configuration('your-resource-group', 'your-web-app', site_config)

After running the above code, Certificate Transparency will be enabled for your Azure web app.

Note: You need to replace the placeholders (your-subscription-id, your-client-id, your-client-secret, your-tenant-id, your-resource-group, your-web-app) with your actual values.

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

Certificate Transparency should be enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

Azure Introduction

Azure Pricing

Azure Threats

Azure Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading: