Azure Storage TLS changes: Intermediate certificate renewals

Question

This is in regard to the information available here:
https://techcommunity.microsoft.com/t5/azure-storage-blog/azure-storage-tls-changes-intermediate-certificate-renewals/ba-p/3929149

We're currently utilizing Remote desktop services to provide access to our application to our users in the form of an RDP icon.

I do see these intermediate certificates mentioned under the certification manager:
Microsoft Azure TLS Issuing CA 01, Microsoft Azure TLS Issuing CA 02, Microsoft Azure TLS Issuing CA 05, Microsoft Azure TLS Issuing CA 06

I wanted to know if will this affect our RDS setup in any terms. [I don't see any connections at my RDS environment with Azure storage services directly]
If yes, What should be done from our end to ensure there are no disruptions later on

Answer 1

Mohit Pathak Are you using certificate pinning? Do you have any client applications that integrate with Azure API or other Azure services? Check with the client application vendor whether they use certificate pinning.

More information about certificate pinning: https://learn.microsoft.com/en-us/azure/security/fundamentals/certificate-pinning

Azure Storage uses some intermediate certificates that are set to expire on 27th June,2024. We expect that most Azure Storage customers will not be impacted, however, your application may be impacted if you explicitly specify a list of acceptable CAs (a practice known as “certificate pinning”)

To mitigate this issue, please check with your application developer if they are using certificate pinning in the application. If yes, you can follow either of the following steps: Add the issuing certificate authorities to your trusted root store. Keep using the current intermediate certificate authorities until they’re updated.

Refer Azure Storage TLS changes: Intermediate certificate renewals - Microsoft Community Hub

Or, to avoid the effects of this update and future certificate updates, discontinue certificate pinning in your applications. This change should not impact Azure portal and how it connects to storage. To conclude certificate pinning is a technique used by the application developer. There is no need of extra configuration changed required from Azure Portal.

Additional reading: #Azure Storage TLS changes: Intermediate certificate renewals - Microsoft Community Hub

#Azure Storage TLS: Critical changes are almost here! (…and why you should care) - Microsoft Community Hub

Refer to this answer here for more details- Source: https://learn.microsoft.com/en-gb/answers/questions/1478102/azure-storage-tls-changes-intermediate-certificate