> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Certificate Transparency should be enabled

### More Info:

Ensure that Certificate Transparency feature is enabled for all Azure Key Vault SSL/TLS certificates in order to adhere to best practices. Certificate Transparency (CT) is a new Internet standard that addresses the concerns about mis-issued certificates by making the Transport Layer Security (TLS) ecosystem publicly auditable.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* Cloudanix Best Practice

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the Certificate Transparency misconfiguration in Azure using Azure console, please follow the below steps:

        1. Login to Azure portal ([https://portal.azure.com/](https://portal.azure.com/))
        2. Navigate to the App Service for which you want to enable Certificate Transparency.
        3. Click on "TLS/SSL settings" under the "Settings" section.
        4. Scroll down to the "Certificate Transparency" section.
        5. Toggle the "Certificate Transparency" switch to "On" position.
        6. Click on "Save" to save the changes.

        After following the above steps, Certificate Transparency will be enabled for the App Service in Azure.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the Certificate Transparency misconfiguration in Azure using Azure CLI, please follow the below steps:

        1. Open the Azure CLI on your local machine or use the Azure Cloud Shell.

        2. Run the following command to create a new resource group:

           ```
           az group create --name <resource-group-name> --location <location>
           ```

           Replace `<resource-group-name>` with a unique name for the resource group and `<location>` with the location where you want to create the resource group.

        3. Run the following command to create a new web app:

           ```
           az webapp create --name <app-name> --resource-group <resource-group-name> --plan <app-service-plan> --runtime "DOTNETCORE|3.1"
           ```

           Replace `<app-name>` with a unique name for the web app, `<resource-group-name>` with the name of the resource group you created in step 2, `<app-service-plan>` with the name of the app service plan you want to use, and `--runtime "DOTNETCORE|3.1"` with the runtime version you want to use.

        4. Run the following command to enable Certificate Transparency for the web app:

           ```
           az webapp config set --name <app-name> --resource-group <resource-group-name> --ftps-state Disabled --http20 Enabled --min-tls-version 1.2 --tls-version-1-0 Disabled --tls-version-1-1 Disabled --tls-version-1-2 Enabled --tls-version-1-3 Enabled --use-32bit-worker-process false --certificate-transparency Enabled
           ```

           Replace `<app-name>` with the name of the web app you created in step 3 and `<resource-group-name>` with the name of the resource group you created in step 2.

        5. Verify that Certificate Transparency is enabled for the web app by running the following command:

           ```
           az webapp config show --name <app-name> --resource-group <resource-group-name> --query certificateTransparency
           ```

           Replace `<app-name>` with the name of the web app you created in step 3 and `<resource-group-name>` with the name of the resource group you created in step 2.

           If the output of the command is `true`, then Certificate Transparency is enabled for the web app.

        That's it! You have successfully remediated the Certificate Transparency misconfiguration for an Azure web app using Azure CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate Certificate Transparency misconfiguration in Azure using Python, you can follow the below steps:

        1. First, you need to check if Certificate Transparency is enabled or not. You can use the Azure SDK for Python to check the status of Certificate Transparency. Here is the sample code to check the status:

        ```python theme={null}
        from azure.mgmt.web import WebSiteManagementClient
        from azure.common.credentials import ServicePrincipalCredentials

        # Set up the credentials
        subscription_id = 'your-subscription-id'
        credentials = ServicePrincipalCredentials(
            client_id='your-client-id',
            secret='your-client-secret',
            tenant='your-tenant-id'
        )

        # Set up the web client
        web_client = WebSiteManagementClient(credentials, subscription_id)

        # Get the web app
        web_app = web_client.web_apps.get('your-resource-group', 'your-web-app')

        # Check if Certificate Transparency is enabled
        if web_app.certificate_transparency_enabled:
            print('Certificate Transparency is enabled')
        else:
            print('Certificate Transparency is disabled')
        ```

        2. If Certificate Transparency is disabled, you need to enable it. You can use the same Azure SDK for Python to enable Certificate Transparency. Here is the sample code to enable it:

        ```python theme={null}
        from azure.mgmt.web.models import SiteConfig

        # Set up the site configuration
        site_config = SiteConfig(
            certificate_transparency_enabled=True
        )

        # Update the web app
        web_client.web_apps.update_configuration('your-resource-group', 'your-web-app', site_config)
        ```

        3. After running the above code, Certificate Transparency will be enabled for your Azure web app.

        Note: You need to replace the placeholders (your-subscription-id, your-client-id, your-client-secret, your-tenant-id, your-resource-group, your-web-app) with your actual values.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://support.microsoft.com/en-us/help/4093260/introduction-of-ad-cs-certificate-transparency](https://support.microsoft.com/en-us/help/4093260/introduction-of-ad-cs-certificate-transparency)
* [https://www.certificate-transparency.org/what-is-ct](https://www.certificate-transparency.org/what-is-ct)