certificate pining in Azure

Question

certificate pining in Azure

P Ramanjaneyulu (TCIN) 0

certificate Pinning

Dillon Silzer 57,686 Reputation points

2023-12-18T05:11:41.6233333+00:00

Are you asking how to do certificate pinning in Azure?
Ravi Kanth Koppala 3,306 Reputation points Microsoft Employee

2023-12-18T07:26:23.3266667+00:00
@P Ramanjaneyulu (TCIN) ,

Azure supports certificate pinning as a security technique to ensure that only authorized certificates are accepted when establishing a secure session. To implement certificate pinning in Azure, you should specify a list of authorized certificates or properties of certificates including Subject Distinguished Names, thumbprints, serial numbers, and public keys in your application. If your application explicitly specifies a list of acceptable CAs, you might periodically need to update pinned certificates when Certificate Authorities change or expire. Additionally, if you have an application that integrates with Azure APIs or other Azure services and you're unsure if it uses certificate pinning, check with the application vendor.

References:

Enterprise certificate pinning overview

What is Certificate pinning?

Azure TLS certificate changes

Best Practices for Azure App Service

Note: This answer is generated using the Microsoft Q&A AI Assist tool.
Sumarigo-MSFT 47,516 Reputation points Microsoft Employee

2023-12-21T06:26:11.66+00:00

@P Ramanjaneyulu (TCIN) Just checking in to see if the below answer helped. If this answers your query, do click "Accept the answer” for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Ramya Harinarthini_MSFT 5,356 Reputation points Microsoft Employee

2024-01-02T09:13:16.66+00:00

@P Ramanjaneyulu (TCIN) Just checking in to see if the below answer helped. If this answers your query, do click "Accept the answer” for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Ramya Harinarthini_MSFT 5,356 Reputation points Microsoft Employee

2024-02-20T06:04:27.4733333+00:00

@P Ramanjaneyulu (TCIN) Just checking in to see if the below answer helped. If this answers your query, do click "Accept the answer” for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

1 answer

Your answer

Dillon Silzer 57,686 Reputation points

2023-12-18T05:11:41.6233333+00:00

Are you asking how to do certificate pinning in Azure?
Ravi Kanth Koppala 3,306 Reputation points Microsoft Employee

2023-12-18T07:26:23.3266667+00:00

@P Ramanjaneyulu (TCIN) ,

Azure supports certificate pinning as a security technique to ensure that only authorized certificates are accepted when establishing a secure session. To implement certificate pinning in Azure, you should specify a list of authorized certificates or properties of certificates including Subject Distinguished Names, thumbprints, serial numbers, and public keys in your application. If your application explicitly specifies a list of acceptable CAs, you might periodically need to update pinned certificates when Certificate Authorities change or expire. Additionally, if you have an application that integrates with Azure APIs or other Azure services and you're unsure if it uses certificate pinning, check with the application vendor.

References:

Enterprise certificate pinning overview

What is Certificate pinning?

Azure TLS certificate changes

Best Practices for Azure App Service

Note: This answer is generated using the Microsoft Q&A AI Assist tool.
Sumarigo-MSFT 47,516 Reputation points Microsoft Employee

2023-12-21T06:26:11.66+00:00

@P Ramanjaneyulu (TCIN) Just checking in to see if the below answer helped. If this answers your query, do click "Accept the answer” for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Ramya Harinarthini_MSFT 5,356 Reputation points Microsoft Employee

2024-01-02T09:13:16.66+00:00

@P Ramanjaneyulu (TCIN) Just checking in to see if the below answer helped. If this answers your query, do click "Accept the answer” for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Ramya Harinarthini_MSFT 5,356 Reputation points Microsoft Employee

2024-02-20T06:04:27.4733333+00:00

@P Ramanjaneyulu (TCIN) Just checking in to see if the below answer helped. If this answers your query, do click "Accept the answer” for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Answer 1

@P Ramanjaneyulu (TCIN) Welcome to Microsoft Q&A, thank you for posting your here!!

We understand you've recently been notified of the changes with the headline "If you use certificate pinning, update your trusted root store for Azure Storage services by 29 February 2024".

Azure Storage services use intermediate TLS certificates that are set to expire in June 2024.

In preparation, we'll begin rolling out updates in March for these expiring certificates in Azure Storage Cloud services, in the public Azure cloud and US Government cloud. (Blob, ADLS Gen2, File, Table, Queue, static websites)

Most Azure Storage customers will not be impacted, but applications using "certificate pinning" may be affected.

If your application explicitly specifies a list of acceptable CAs, your application was likely impacted. This practice is known as certificate pinning. Review the Microsoft Tech Community article on Azure Storage TLS changes for more information on how to determine if your services were impacted and next steps.

Here are some ways to detect if your application was impacted:

Search your source code for the thumbprint, Common Name, and other cert properties of any of the Microsoft IT TLS CAs in the Microsoft PKI repository. If there's a match, then your application will be impacted. To resolve this problem, update the source code include the new CAs. As a best practice, ensure that CAs can be added or edited on short notice. Industry regulations require CA certificates to be replaced within seven days of the change and hence customers relying on pinning need to react swiftly.

Required action:

If you have client applications that have pinned to intermediate certificate authorities, take one of these actions by 29 February 2024 to prevent interruptions to your connections:

Add the issuing certificate authorities to your trusted root store and keep using the current intermediate certificate authorities until they're updated. See: Azure Storage TLS changes: Intermediate certificate renewals - Microsoft Community Hub.-,How%20to%20check,-If%20your%20client"https://techcommunity.microsoft.com/t5/azure-storage-blog/azure-storage-tls-changes-intermediate-certificate-renewals/ba-p/3929149#:~:text=prevent%20connection%20interruption).-,how%20to%20check,-if%20your%20client")
Or to avoid the effects of this update and future certificate updates, discontinue certificate pinning in your applications. Links:

Certificate pinning - Certificate pinning and Azure services | Microsoft Learn

Azure TLS Certificate Changes | Microsoft Learn

Azure Storage TLS: Critical changes are almost here! (…and why you should care) - Microsoft Community Hub

Hope this helps!
Kindly let us know if the above helps or you need further assistance on this issue.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Share via

certificate pining in Azure

1 answer

Your answer