# TLS inspection certificates have a sufficient validity period
TLS inspection uses an intermediate certificate authority to dynamically create leaf certificates for decrypting and inspecting encrypted traffic.
Source: https://maester.dev/docs/tests/ZTA.27002
## Overview
TLS inspection uses an intermediate certificate authority to dynamically create leaf certificates for decrypting and inspecting encrypted traffic. When this certificate expires, the service can't perform TLS termination. This expiration immediately disables all TLS inspection capabilities, including URL filtering, threat detection, and data loss prevention on HTTPS traffic. Threat actors know that security controls often lapse during certificate expiration and they time attacks to coincide with these gaps.
If a certificate expires:
- The organization loses visibility into encrypted traffic.
- Threat actors can bypass TLS inspection to deliver encrypted malware, access command-and-control communications, and exfiltrate data.
## Remediation
- Maintain a 90-day buffer before certificate expiration to provide time to complete the renewal process. Microsoft recommends that signed certificates remain valid for at least six months.
- Follow the steps in [Configure Transport Layer Security inspection settings](https://learn.microsoft.com/entra/global-secure-access/how-to-transport-layer-security-settings?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) to:
- Create a new Certificate Signing Request (CSR) and upload a renewed certificate in the Microsoft Entra admin center.
- Sign the CSR by using your organization's PKI infrastructure with a validity period of at least six months (Microsoft recommendation).
- Use [Active Directory Certificate Services (ADCS)](https://learn.microsoft.com/entra/global-secure-access/scripts/powershell-active-directory-certificate-service?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) or [OpenSSL](https://learn.microsoft.com/entra/global-secure-access/scripts/powershell-open-secure-sockets-layer?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) to sign the CSR.
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | High |
| Pillar | Network |
| Category | Global Secure Access |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Global Secure Access |
| Area | Access control |
| ATT&CK | [T1573](/docs/tests?mitre=T1573) Encrypted Channel, [T1071.001](/docs/tests?mitre=T1071.001) Web Protocols |
| Licence | Entra_Premium_Internet_Access |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.