TLS inspection certificates have a sufficient validity period

Overview

TLS inspection uses an intermediate certificate authority to dynamically create leaf certificates for decrypting and inspecting encrypted traffic. When this certificate expires, the service can’t perform TLS termination. This expiration immediately disables all TLS inspection capabilities, including URL filtering, threat detection, and data loss prevention on HTTPS traffic. Threat actors know that security controls often lapse during certificate expiration and they time attacks to coincide with these gaps.

If a certificate expires:

• The organization loses visibility into encrypted traffic.
• Threat actors can bypass TLS inspection to deliver encrypted malware, access command-and-control communications, and exfiltrate data.

Remediation

• Maintain a 90-day buffer before certificate expiration to provide time to complete the renewal process. Microsoft recommends that signed certificates remain valid for at least six months.
• Follow the steps in Configure Transport Layer Security inspection settings to:
  • Create a new Certificate Signing Request (CSR) and upload a renewed certificate in the Microsoft Entra admin center.
  • Sign the CSR by using your organization’s PKI infrastructure with a validity period of at least six months (Microsoft recommendation).
• Use Active Directory Certificate Services (ADCS) or OpenSSL to sign the CSR.

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	High
Pillar	Network
Category	Global Secure Access
Product	Entra ID
Feature	Global Secure Access
Area	Access control
ATT&CK	T1573 Encrypted Channel, T1071.001 Web Protocols
Licence	Entra_Premium_Internet_Access
Tenant	Workforce, External

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.