Share via

Intermediary certificate changes tracking

Patel, Sanjaykumar 0 Reputation points
2024-07-10T16:34:29.4+00:00

Hello Team,

There are a few applications that use Azure Logic Apps and Azure Functions. We have spotted that this week the Azure Logic Apps URL has a new intermediary certificate. It has changed the intermediary from 'Microsoft Azure RSA TLS Issuing CA 07' to 'Microsoft Azure RSA TLS Issuing CA 08'. Due to this certificate change, the handshake has been broken. Is there any tracking page, that we can follow for any similar certificate update plan on Azure Logic Apps , Functions, etc.?

This will save us from being broken, and we can maintain the same intermediary certificate in advance at API Gateway for handshakes.

Thanks,

Sanjay Kumar Patel

Azure Functions
Azure Functions
An Azure service that provides an event-driven serverless compute platform.
4,603 questions
Azure Logic Apps
Azure Logic Apps
An Azure service that automates the access and use of data across clouds without writing code.
2,968 questions
Azure App Service
Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
7,317 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Luke Murray 10,636 Reputation points MVP
    2024-07-11T05:41:17.6233333+00:00

    Hi,

    Sounds like you have Certificate pinning.

    Usually, your subscription owners should have received an email alert about the change before it happened to give you time to prepare; you can see the Changelog of the change Under the Past changes heading of the Certificate Authority page below.

    Reference:

    Azure Certificate Authority details

    What is Certificate pinning?

    Microsoft hits snooze again on security certificate renewal

    0 comments
  2. JananiRamesh-MSFT 23,411 Reputation points
    2024-07-11T08:03:40.3866667+00:00

    @Patel, Sanjaykumar Thanks for reaching out. Certificate changes are something we don't have a way to advertise. Customers should make sure that all security patches are installed in their operating systems Whenever new certs are rolled out, OS security patches make sure that those are trusted root certs on the machine.

    Avoid using certificate pinning. please refer: https://learn.microsoft.com/en-us/azure/security/fundamentals/certificate-pinning

    https://learn.microsoft.com/en-us/azure/security/fundamentals/tls-certificate-changes

    Monitor the Azure Service Updates page to stay informed about any upcoming changes to the intermediary certificates used by Azure services.

    https://azure.microsoft.com/en-us/updates/?query=TLS

    please refer this blog for more information https://techcommunity.microsoft.com/t5/azure-storage-blog/azure-storage-tls-changes-intermediate-certificate-renewals/ba-p/3929149

    do let me know incase of further queries, I would be happy to assist you.

    0 comments