update your trusted root store for Azure Storage services

Question

Hello community! I have a question and I would like to share it with you. We received an email from Microsoft stating: "If you use certificate pinning, update your trusted root store for Azure Storage services by 29 February 2024." Our company uses the Azure Blob Storage service only to store backups through a third-party tool. My question is about the impact this update might have on our scenario, since I didn't identify the certificates section in the storage account and didn't find clear information in Microsoft's documentation about how this would affect data storage. As a precautionary measure, I am contacting the company providing the software to better understand the impact of this update. If anyone has any experience or knowledge on this subject, I would be grateful for any additional information you can provide.

Answer 1

@Lucas Soares Thanks for posting your query on Microsoft Q&A.

We expect that most Azure Storage customers will not be impacted; however, your application may be impacted if you explicitly specify a list of acceptable CAs (a practice known as “certificate pinning”).

If any client application has pinned to the root CA Baltimore CyberTrust Root or current intermediate CAs listed in the table below, immediate action is required to prevent disruption to connectivity to Azure Storage.  

Action Required: 

• If your client application has pinned to the Baltimore CyberTrust Root CA, in addition to Baltimore, add the DigiCert Global Root G2 to your trusted root store before February 2022. 
• If your client application has pinned to the intermediate CAs, in addition to Microsoft RSA TLS CAs, add the Microsoft Azure TLS Issuing CAs to your trusted root store before February 2022. 
• Keep using the current root or intermediate CAs in your applications or devices until the transition period is completed (necessary to prevent connection interruption). 
• Make sure SHA384 for Server certificate processing is enabled on the device.

 How to check:

If your client application has pinned to  

• Root CA: Baltimore CyberTrust Root CA or,  
• Intermediate CA:  Microsoft RSA TLS CA 01 
• Intermediate CA:  Microsoft RSA TLS CA 02 
• Intermediate CA: Microsoft Azure TLS Issuing CA 01
• Intermediate CA: Microsoft Azure TLS Issuing CA 02
• Intermediate CA: Microsoft Azure TLS Issuing CA 05
• Intermediate CA: Microsoft Azure TLS Issuing CA 06

then search your source code for the thumbprint, Common Name, and other cert properties of any of the root CA or intermediate CAs. If there is a match, then your application will be impacted, immediate action is required. 

In your scenario, it's the right step to check with the third-party software provider to understand how they handle certificate validation. If they rely on Azure Storage services, they should be aware of these changes. If the third-party tool explicitly pins certificates, ensure it supports the updated certificates. If not, you may need to adjust the configuration.
Also, monitor your backups after the certificate update to ensure seamless functionality.

If you have questions, please let me know in the "comments" and we would be happy to help you. Comment is the fastest way of notifying the experts. Please don’t forget to Accept Answer and hit Yes for "was this answer helpful" wherever the information provided helps you, this can be beneficial to other community members for remediation for similar issues.

Answer 2

The email you received from Microsoft regarding updating your trusted root store for Azure Storage services is related to the Azure TLS certificate changes. If your application uses certificate pinning, it is important to update your trusted root store to ensure that your services are not impacted. However, since your company only uses Azure Blob Storage service to store backups through a third-party tool, it is unlikely that this update will have any impact on your scenario. As a precautionary measure, it is a good idea to contact the company providing the software to better understand the impact of this update.

---

References:

• Azure TLS certificate changes
• Azure Storage TLS certificate changes