Application certificates must be rotated on a regular basis
Overview
Section titled “Overview”If certificates aren’t rotated regularly, they can give threat actors an extended window to extract and exploit them, leading to unauthorized access. When credentials like these are exposed, attackers can blend their malicious activities with legitimate operations, making it easier to bypass security controls. If an attacker compromises an application’s certificate, they can escalate their privileges within the system, leading to broader access and control, depending on the application’s privileges.
Query all of your service principals and application registrations that have certificate credentials. Make sure the certificate start date is less than 180 days.
Remediation
Section titled “Remediation”- Define an application management policy to manage certificate lifetimes
- Define a trusted certificate chain of trust
- Create a least privileged custom role to rotate application credentials
- Learn more about app management policies to manage certificate based credentials
Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | High |
| Effort to fix | High |
| Impact on users | Low |
| Pillar | Identity |
| Category | Application management |
| Product | Entra ID |
| Feature | Applications |
| Area | Applications and workload identities |
| ATT&CK | T1552.004 Private Keys, T1078.004 Cloud Accounts |
| Licence | Free |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.