Ensure that Certificate Transparency feature is enabled for all Azure Key Vault SSL/TLS certificates in order to adhere to web security best practices. Certificate Transparency (CT) is a new Internet standard that addresses the concerns about mis-issued certificates by making the Transport Layer Security (TLS) ecosystem publicly auditable. Without CT, as domain owner there is no way to be aware of certificates that are issued to your domain, unless you request it yourself. With Certificate Transparency, you can easily audit the quality of the certificates that the Certificate Authority (CA) issued and determine whether the certificate is compliant with the standards enforced by the Certification Authority Browser Forum, also known as CA/Browser Forum.
This rule resolution is part of the Conformity Security & Compliance tool for Azure.
Certificate Transparency aims to remediate SSL/TLS certificate-based threats by making the issuance process and the existence of the certificates open to scrutiny by domain owners, CAs, and domain users. Specifically, Certificate Transparency (CT) has three main goals:
Make it extremely difficult for a Certificate Authority (CA) to issue an SSL certificate for a domain without the certificate being visible to the owner of that domain.
Provide an open auditing and a monitoring system that allows any domain owner or CA to determine whether the SSL certificate has been mistakenly or maliciously issued.
Protect users from being duped by SSL certificates that were mistakenly or maliciously issued.
To determine if your Microsoft Azure Key Vault SSL/TLS certificates are configured to use certificate transparency, perform the following operations:
Remediation / Resolution
To enable certificate transparency for your Microsoft Azure Key Vault SSL/TLS certificates, perform the following actions:
- Azure Official Documentation
- About keys, secrets, and certificates
- Introduction of AD CS Certificate Transparency
- Azure Command Line Interface (CLI) Documentation
- az keyvault list
- az keyvault certificate list
- az keyvault certificate show
- az keyvault certificate set-attributes
- Certificate Transparency Project Documentation
- What is Certificate Transparency?
Unlock the Remediation Steps
Free 30-day Trial
Automatically audit your configurations with Conformity
and gain access to our cloud security platform.
You are auditing:
Enable Certificate Transparency
Risk level: Medium