Reminder Azure TLS certificate changes

bharathn-msft 5,086 Microsoft Employee

Hello Azure Customers in the community,

For users that implement certificate pinning in their application code there are some Azure TLS certificate changes that could impact some of our customers. Microsoft is updating Azure services to use TLS certificates from a different set of Root Certificate Authorities (CAs). This change is being made because the current CA certificates do not comply with one of the CA/Browser Forum Baseline requirements. We expect that most Azure customers will not be impacted. However, your application may be impacted if it explicitly specifies a list of acceptable CAs. To learn more please click here.

For any other further help, please reach out to our Support team via Azure portal. Thank you

Dragos P 1 Reputation point

2020-10-13T09:14:37.507+00:00

what root CA will the azure API use
Hello,
I have some on-prem apps that are consuming an Azure API. It was very hard to identify which certs to add in the on-prem app's trust store already in order to ensure communication between them. Now can you please be more specific regarding which exact root CA will be used by the Azure APIs from the list you shared in the article?

"
TLS certificates used by Azure services will chain up to one of the following Root CAs:

WHAT IS CHANGING?
Common name of the CA Thumbprint (SHA1)
DigiCert Global Root G2 df3c24f9bfd666761b268073fe06d1cc8d4f82a4
DigiCert Global Root CA a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c5436
Baltimore CyberTrust Root d4de20d05e66fc53fe1a50882c78db2852cae474
D-TRUST Root Class 3 CA 2 2009 58e8abb0361533fb80f79b1b6d29d3ff8d5f00f0
Microsoft RSA Root Certificate Authority 2017 73a5e64a3bff8316ff0edccc618a906e4eae4d74
Microsoft EV ECC Root Certificate Authority 2017 6b1937abfd64e1e40daf2262a27857c015d6228d
darshani jayasekara 1 Reputation point

2020-10-14T04:06:03.953+00:00

Hi,

We have a couple of Azure app services hosted in Azure, but we do not have explicitly hard-coded trusted root lists in our code. One of the app service use as a Remote event Receiver which triggers by a Sharepoint list.

Could you please let me know if these app services can get impacted by the change?
ccaIT 1 Reputation point

2020-10-14T09:02:52.26+00:00

Hi
Not sure if my org will be impacted by this at all
Using win acme through Azure VM Windows Server 2012 R2 to issue SSL certs
Is there anything I need to action on my end to ensure not issues with our websites?

Thanks in advance
Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,426 Reputation points

2020-10-14T15:27:59.483+00:00

if your application code is not hard coded or configured to trust any of the following CAs or certs signed by any of the former then you won't get affected.
Tijana Kostic 1 Reputation point

2020-10-15T07:48:52.703+00:00

My certificate is issued to me by Microsoft IT TLS CA 5 but it is not Microsoft IT TLS CA 5.crt. The name of my certificate is hardcoded in my code.
Will there be any impact? Thank you for your help!
Quentin Bracken 26 Reputation points Microsoft Employee

2020-10-15T16:47:00.51+00:00

Azure services use a variety of PKIs. As described in the update, it's important that your clients trust all of the specified roots to ensure maximum compatibility with Azure services. While the Azure APIs use a particular root today, they may use a different root tomorrow. They may also use different roots based on their geolocation. It's important that your client trusts all the roots and not a specific one to avoid a potential outage.
Quentin Bracken 26 Reputation points Microsoft Employee

2020-10-15T16:49:09.44+00:00

If you are using ACME, I assume you are getting your certificates for Let's Encrypt. If that's the case, then your services won't be impacted. However, if you are also a client of Azure services, then your client must be updated to trust the roots provided.
Quentin Bracken 26 Reputation points Microsoft Employee

2020-10-15T16:50:30.507+00:00

Yes, certificates issued by Microsoft IT TLS CA 5 are in scope. You must take action.
Abhishek Singh 1 Reputation point

2020-10-16T11:16:06.7+00:00

We are using Virtual machine using windows and Linux to host our applications and SQL Server for database. Does "Review your Azure Services Certificate Authorities" this impact any of the application or database hosts on azure VM.
Mike Gowing 1 Reputation point

2020-10-16T13:31:47.85+00:00

Does this have an affect on enterprise applications in Azure AD? More specifically around applications we configure SSO for like Salesforce, Adobe Creative Cloud, etc.
Quentin Bracken 26 Reputation points Microsoft Employee

2020-10-16T16:21:06.55+00:00

Most likely not. If you have an application that calls into any Azure endpoint, you should verify that your application is not doing any certificate pinning. Certificate pinning is the practice of comparing properties of the certificate chain provided by the remote endpoint to a list of expected values. For example, you may have hard coded your application to expect a specific thumbprint, serial number, or common name value from the certificate so that only a specific certificate would be authorized. If you have such a configuration, you must take action.
darshani jayasekara 1 Reputation point

2020-10-19T02:43:13.987+00:00

Thank you for the confirmation.
bharathn-msft 5,086 Reputation points Microsoft Employee

2020-10-19T18:24:21.787+00:00

@Mike Gowing Thank you for reaching out to us. . 3rd party services like Salesforce, Adobe are not impacted, whether or not it's an enterprise app in Azure AD is independent to the issue. Hope this information helps, please feel free to revert back if you have any further queries.
Rakesh Reddykunuthuru (MINDTREE LIMITED) 1 Reputation point

2020-10-20T11:42:50.813+00:00

In Azure portal regarding app services i have no concerns . I have a VM running windows in azure and i host few apps on that VM and for those certificate is provided by GO DADDY.com and we have the certificate service till 2021 by go daddy . Does this TLS certificate changes impact my VM and my app on VM? Awaiting your reply . Hope will get reply soon .

Many thanks .
Rakesh Reddykunuthuru (MINDTREE LIMITED) 1 Reputation point

2020-10-20T12:08:14.333+00:00

In Azure portal regarding app services i have no concerns . I have a VM running windows in azure and i host few apps on that VM and for those certificate is provided by GO DADDY.com and we have the certificate service till 2021 by go daddy . Does this TLS certificate changes impact my VM and my app on VM? Awaiting your reply .
Quentin Bracken 26 Reputation points Microsoft Employee

2020-10-20T15:57:23.73+00:00

Certificates issued by GoDaddy are not in scope.
Rakesh Reddykunuthuru (MINDTREE LIMITED) 1 Reputation point

2020-10-20T15:59:34.36+00:00

which means they wont be affected right because of TLS changes? Do we need to check anything?
Philip Salqvist 1 Reputation point

2020-10-20T16:01:10.747+00:00

Hi,

I'm running a powerapps app connected to an Azure database. Does powerapps use certificate pinnings? Will apps running on the powerapps environment be effected by the TLS certificate changes?

Regards, Philip Salqvist
Quentin Bracken 26 Reputation points Microsoft Employee

2020-10-20T16:10:41.357+00:00

The services hosted on your VM that use your GoDaddy certificate are not affected and you don't need to do anything for them. However, if your VM has a custom client that consumes other services from Azure via an API, you should check your client code to ensure it either isn't performing certificate pinning or, if it is, that it will accept certs from the complete list of roots provided.
Quentin Bracken 26 Reputation points Microsoft Employee

2020-10-20T16:15:06.397+00:00

Assuming that you are asking about Microsoft Power Apps on Azure (https://azure.microsoft.com/en-us/products/powerapps/), then there is no action for you. Microsoft Power Apps on Azure does not perform certificate pinning natively.
1stname 2ndname 1 Reputation point

2020-10-23T10:38:29.553+00:00

Hello.
I am using the "Microsoft Translator API" from my on-premises software.
Do I need to change my software with Azure TLS certificate changes?
Thank you for your help.
Quentin Bracken 26 Reputation points Microsoft Employee

2020-10-23T17:54:04.623+00:00

Most likely not. If you have an application that calls into any Azure endpoint, you should verify that your application is not doing any certificate pinning. Certificate pinning is the practice of comparing properties of the certificate chain provided by the remote endpoint to a list of expected values. For example, you may have hard coded your application to expect a specific thumbprint, serial number, or common name value from the certificate so that only a specific certificate would be authorized. If you have such a configuration, you must take action.
1stname 2ndname 1 Reputation point

2020-10-26T07:52:35.527+00:00

Thanks for the reply.
Let me confirm it a little more.

I am not using private endpoint or service endpoint from the software.
I am using the Microsoft Translator API from the software with a Cognitive service subscription key.
Therefore, it is not necessary to change the software.
Is this perception correct?
Quentin Bracken 26 Reputation points Microsoft Employee

2020-10-29T23:48:08.597+00:00

You will be OK.
jwhitlock 1 Reputation point

2020-11-17T22:51:42.517+00:00
We are verifying VMs by inspecting the attested data API. This returns a PKCS#7 message, signed by an included certificate that was issued by one of four "Microsoft IT TLS CA" intermediate certificates, in turn issued by the "Baltimore CyberTrust Root" CA. As announced on Azure TLS Certificate Changes, the Microsoft IT TLS CA certificates will be revoked on February 15, 2021. We are preparing for supporting unknown intermediate certificates that are issued by one of the 6 mentioned CAs.

My questions are:

Is there a planned date that the attested data signing certificate chain will change?

Do you know which root CAs are planned for this purpose? We can support the 5 RSA certificates, but can't yet support the "Microsoft ECC Root Certificate Authority 2017" root CA, as our library doesn't support ECC.
bharathn-msft 5,086 Reputation points Microsoft Employee

2020-11-20T01:38:38.907+00:00

@jwhitlock Thank you for reaching out, to further help can you please help share more information on what specific method name you are referencing with in the API. Looking forward to hear back from you. Thank you
jwhitlock 1 Reputation point

2020-11-20T03:32:55.137+00:00
The attested data API is reachable in a VM at a URL like

Invoke-RestMethod -Headers @{"Metadata"="true"} -Method GET -NoProxy -Uri "http://169.254.169.254/metadata/attested/document?api-version=2018-10-01&nonce=1234567890"

The return is JSON, partially shown here due to the character limits of this forum, see the attested data API documentation:

{ "encoding":"pkcs7", "signature":"MIIEEgYJKoZIhvcNAQcCoIIEAzCCA/8C..." }

The signature is the PKCS7 signed version of the document. The signing certificate is embedded in the message, and is issued by one of the 4 Microsoft IT TLS CA that are planned to be revoked and replaced.
Quentin Bracken 6 Reputation points

2020-11-20T20:39:03.937+00:00

The Microsoft Azure Attestation API endpoints will remain on the Baltimore CyberTrust Root. They will be moving to one of the new intermediate CAs: Microsoft RSA TLS CA 01 and Microsoft RSA TLS CA 02. The ETA for this change for this specific endpoint is 12/1.

21 answers

chirag sharma 1 Reputation point

2020-10-13T06:59:50.937+00:00

We use Cloudflare as our Certificate Authority.

Will we need to make any changes or updates in our certificates/app services?

Thanks In Advance
Please sign in to rate this answer.
bharathn-msft 5,086 Reputation points Microsoft Employee

2020-10-16T06:02:04.46+00:00

@chirag sharma - Thank you for reaching out, in your scenario there shouldn't be any impact because of the Azure TLS Certificate Change.
Sign in to comment
Henry Zaragoza Jr 1 Reputation point

2020-10-13T07:28:32.497+00:00

Hello @bharathn-msft , I am new to Azure. I would like to ask/know if these changes will affect the application insights that we are using in azure? Thank you in advance
Please sign in to rate this answer.
StephenShi 1 Reputation point

2020-10-13T10:26:04.76+00:00

Hi @bharathn-msft , I have the same question. I received MS email and says "Your applications may be impacted if you explicitly specify a list of acceptable CAs (a practice known as certificate pinning). " . I am not sure what applications are, but I think I only use Application Insights on Azure.

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,426 Reputation points

2020-10-14T15:21:16.677+00:00

@Henry Zaragoza Jr @StephenShi application insights won't get affected.
Sign in to comment
Girish Prajwal 706 Reputation points

2020-10-13T14:15:57.907+00:00

Hi @bharathn-msft ,

We received similar alert today, and I verified that both our WebApps and IOT services are not using any certificates. However, we have multiple storage accounts in our subscriptions. How can I identify which storage or the Azure service will be impacted?

Give me insights.

Along with this, I am unsure how did my friend received this alert and not me. Is it because the certificates were raised by him using our on-premise Root CA.

How can I check "How did he receive this alert from Microsoft" if this was an alert set in Azure.

Regards,

Girish Prajwal
Please sign in to rate this answer.
bharathn-msft 5,086 Reputation points Microsoft Employee

2020-10-15T06:43:41.953+00:00

@Girish Prajwal Thank you for reaching out and apologies for the delayed response. Updated the response for your queries on other thread.
Sign in to comment
Vipin Nair 1 Reputation point

2020-10-13T15:08:46.397+00:00

I got a email from MS for Review your Azure Services Certificate Authorities.
We have integrated few applications with Azure AD as Enterprise application for SSO. Are those application impacted?
Please sign in to rate this answer.
Shashi Shailaj 7,581 Reputation points Microsoft Employee

2020-10-13T18:35:27.93+00:00

@Vipin Nair , If you are not using Certificate pinning in your environment then they are not affected. If you are using it then you will need to add 5 new certificate authorities in the acceptable CA list as in this article. If you are unsure of whether certificate pinning is implemented in your environment , please check the network security team or the team which manages internal certificate authority servers within your Internal IT and they should be able to help on the same.

Thank you.

Vipin Nair 1 Reputation point

2020-10-13T19:03:08.667+00:00

Thanks for your quick response. How about SAAS applications? Application integrated for SSO are all SAAS applications.

Shashi Shailaj 7,581 Reputation points Microsoft Employee

2020-10-14T15:44:13.773+00:00

@Vipin Nair , I think the SaaS providers would take care of that if they are using any kind of certificate pinning so you would not have to worry about that . This advisory will mostly affect applications that you have developed in-house and your app calls some azure services API to perform your designated tasks and you have done certificate pinning (defined a list of accepted certificates for any communication with Azure. )
Sign in to comment
Jung Choi 27 Reputation points

2020-10-13T15:11:58.413+00:00

If you are simply running VMs with Azure, are those services impacted?

I do have public facing IPs that serve up our application via the VMs but not using the App services.

How are these impacted?
Please sign in to rate this answer.
Shashi Shailaj 7,581 Reputation points Microsoft Employee

2020-10-13T18:52:17.91+00:00

@Jung Choi , I do not think so . If you are not using any certificate pinning or specify any azure certificate thumbprint ,explicitly in your app code , you should be good. However if you do , you may need to add 5 new root CA certificates as listed here. If you have any storage or ioT related azure assets in your application infrastructure , please check the linked articles for more details and mitigation. I am not completely sure about your architecture but if they are just VMs and you do not use any certificate pinning then you should be good. However I strongly recommend checking the articles.

Jung Choi 27 Reputation points

2020-10-13T19:08:53.923+00:00

Ok thank you. I figured that was the case but wanted to verify.
Sign in to comment

Share via

**Reminder** Azure TLS certificate changes

21 answers

Reminder Azure TLS certificate changes