Impact of Azure Storage Root Store Update on TLS Connections

Question

What should I do to ensure my Azure Storage services are not affected by the upcoming changes to the trusted root store and intermediate certificates?

 "PS - Based on common issues that we have seen from customers and other sources, we are posting these questions to help the Azure community."

Answer 1

Greetings!

Azure Storage is updating its trusted root store and intermediate certificates, which might impact your services if your application uses certificate pinning. Certificate pinning, where a list of acceptable Certificate Authorities (CAs) is explicitly specified, is no longer considered a best practice.

To avoid any disruptions:

1. Add the issuing certificate authorities to your trusted root store: This ensures that your services will continue to trust the new intermediate certificates.
2. Discontinue certificate pinning: This practice will help avoid issues with not only this update but also any future certificate updates.

The changes will affect Azure Storage services including Blob, File, Table, Queue, Static Website, and ADLS in the public Azure cloud and US Government cloud. There are no changes for other sovereign clouds like Azure China.

For more detailed guidance, you can refer to the following resources:

• Certificate pinning and Azure services
• Azure Storage TLS changes: Intermediate certificate renewals

Hope this helps. If you have any follow-up questions, please let me know. I would be happy to help.

Please do not forget to "up-vote" wherever the information provided helps you, as this can be beneficial to other community members.