server certificates using "App Service Certificates"

Question

Does issuing server certificates using "App Service Certificates" comply with the IPA's "TLS Cipher Settings Guidelines"?

https://www.ipa.go.jp/security/crypto/guideline/gmcbt80000005ufv-att/ipa-cryptrec-gl-3001-3.1.0.pdf

Specifically, I would like to confirm whether or not the requirements in "5.2 Server Certificates" on page 49 are met,

but I am unable to find any documentation that clearly states this.

Answer 1

Shinji Aota-sama,畦田信治

Q&A portaru nite "App Service Certificates" o shiyō shita sābā shōmeisho ni kansuru goshitsumon o tōkō itadaki, makoto ni arigatō gozaimasu. IPA no "TLS angō settei gaidorain" e no junkyo ni tsuite otazune itadaita ken, kanō na kagiri wakariyasuku go-setsumei sasete itadakimasu.

Azure App Service Certificates wa, shinrai sareta nintei kikan (deforuto de wa DigiCert) ni yotte hakko sare, gendai-teki na angōka hyōjun o sapōto shite orimasu. Microsoft ga chiiki-goto no gaidorain e no junkyo o meijiteki ni kijō shite inai wake de wa arimasen ga, hon-sābisu de seisei sareru shōmeisho wa ippan-teki ni TLS ni okeru gyōkai no besuto purakutisu ni sotte imasu. Tatoeba, RSA 2048-bitto ijō no kagi-chō ya SHA-256 hasshu o sapōto shite ori, sekuritē yōken no ōku o mitashite imasu. Shōsai wa Microsoft kōsho dokyumento "Azure App Service deno TLS/SSL binding o shiyō shita kasutamu DNS-mei no hogo" o go-sanshō kudasai.

IPA gaidorain no "5.2 Sābā shōmeisho" (yūkō kikan ya kagi shiyō-hō nado) ni kan shite wa, App Service Certificates mo dōyō no kijun o oyoso mitashite imasu. Tadashi, Microsoft ga gaibu kikaku to no chokusetsu-teki na taiō-hyō o kōkai shite inai tame, ichibu no kōmoku wa go-jishin de no kakunin ga hitsuyō to naru kanōsei ga gozaimasu. Tatoeba, shōmeisho no deforuto yūkō kikan wa 1-nenkan de ari, kore wa ōku no sekuritē furemuwāku de saiyō sarete iru kikan de gozaimasu. Azure deno shōmeisho kanri no shōsai wa "Azure App Service deno TLS shōmeisho no kanri" o goran kudasai.

Moshi tsuika de go-fumei na ten ga gozaimashitara, enryo naku o-shirase kudasai. TLS ya shōmeisho kanri wa shoshinsha no kata ni wa fukuzatsu ni kanjirareru kamo shiremasen node, kanō na kagiri sapōto sasete itadakimasu.

Keigu,
Alex
P.S. If my answer help to you, please Accept my answer
PPS That is my Answer and not a Comment
https://ctrlaltdel.blog/

Answer 2

Hi @畦田信治,

Azure App Service Certificates are issued by trusted certificate authorities, such as DigiCert, and support modern encryption standards. While Microsoft doesn't directly publish region-specific compliance with IPA guidelines, the certificates issued by App Service generally follow industry best practices. These include:

• RSA keys of 2048 bits or greater
• SHA-256 hashing

As for the IPA guidelines, specifically Section "5.2 Server Certificates" (covering validity periods, key usage, etc.), Azure App Service Certificates meet most of these requirements. However, Microsoft doesn’t provide a direct mapping to external specifications, so some items may require internal verification. For example, the default validity period for certificates in Azure is one year, which is common across many security frameworks.

Additionally, Azure App Service Certificates comply with core requirements of the IPA's TLS Cipher Settings Guidelines. Specifically:

• TLS Protocol Support: Azure App Service supports TLS 1.2 (enabled by default) and TLS 1.3 for incoming client requests.
• Cipher Suites: App Service uses strong cipher suites for both TLS 1.2 and 1.3, including:
  • For TLS 1.3: TLS_AES_256_GCM_SHA384 and TLS_AES_128_GCM_SHA256
  • For TLS 1.2: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 and others, all of which match the IPA-recommended cipher sets.
• Key Strength and Hash Algorithm: Certificates use RSA 2048-bit keys (minimum) and SHA-256 or stronger for digital signatures, meeting the IPA’s key strength and hash requirements.
• Control Over Cipher Suites: You can manage cipher suites and set a minimum TLS version in the Azure App Service configuration to meet any additional security needs.

For more details on managing certificates in Azure, Please refer the following Microsoft documentation: Managing TLS certificates in Azure App Service, Cipher Suites on Azure App Services, FAQ on App Service cipher suites.

Hope it helps!

---

Please do not forget to click "Accept the answer” and Yes wherever the information provided helps you, this can be beneficial to other community members.

If you have any other questions or still running into more issues, let me know in the "comments" and I would be happy to help you.