{"id":6103,"date":"2021-01-11T16:29:15","date_gmt":"2021-01-12T00:29:15","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=6103"},"modified":"2023-06-11T13:38:10","modified_gmt":"2023-06-11T20:38:10","slug":"making-renewing-certificates-easier-at-microsoft-with-microsoft-azure","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/making-renewing-certificates-easier-at-microsoft-with-microsoft-azure\/","title":{"rendered":"Making renewing certificates easier at Microsoft with Microsoft Azure"},"content":{"rendered":"
This content has been archived, and while it was correct at time of publication, it may no longer be accurate or reflect the current situation at Microsoft.<\/p>\n<\/div>\n<\/div>\n
Cybersecurity is a constant challenge at Microsoft.<\/p>\n
To protect the connections between computer servers, resources, and their users, the company regularly uses digital certificates signed by trusted authority providers.<\/p>\n
Every quarter, the Microsoft Digital team is responsible for some 4,000 digital certificate renewals. At two to four hours to do each one, sometimes more, this used tens of thousands of labor hours every year.<\/p>\n
What if there were a way to avoid the manual, time-consuming tasks normally associated with certificate renewal? That\u2019s the question that Wilson Gajarla, a senior software engineer in Microsoft Digital, faced after an incident with an important certificate on a local machine in a Microsoft lab at the company headquarters in Redmond.<\/p>\n
When Gajarla and team noticed that the certificate was about to expire, they realized it would take more than a few hours to renew it. In this case, the lab itself was off-limits due to COVID-19 so the machine wasn\u2019t easily reachable to perform the manual renewal process.<\/p>\n
Fortunately, Gajarla was granted special permission to enter the building due to business urgency, and was able to renew the certificate in time. But the experience stuck with Gajarla.<\/p>\n
Gajarla began to look for better ways to manage server security, even in cases where an administrator can\u2019t connect remotely to a machine.<\/p>\n
[<\/em>See how Microsoft Azure Front Door makes it easy for two apps to boost availability and security.<\/em><\/a> Find out what Microsoft learned from applying Zero Trust principles during COVID-19.<\/em><\/a> Get inspired by Microsoft use of Microsoft Azure APIs to develop a robust external supplier catalog.<\/em><\/a>] <\/em><\/p>\n A heavy load for server and resource administrators<\/strong><\/p>\n Today\u2019s servers and websites use digital certificates to provide a high level of security that\u2019s easy to take for granted, but this practice comes with a steep cost.<\/p>\n \u201cIt can take several hours to renew a server certificate,\u201d says Ashish Sayal, a principal software engineering manager in Microsoft Finance. \u201cIt\u2019s a manual process, so there\u2019s always the risk of error or even bringing down the server if it\u2019s not done correctly. This impacts the level of customer trust and the organization\u2019s reputation.\u201d<\/p>\n The engineers who are responsible for certificates must anticipate upcoming expirations, renew them based on the issue date, and then upload the newly signed certificate to all the resources that are using it. Finally, they have to communicate to all the certificate consumers the need to renew the new version on their resources as well.<\/p>\n Sometimes authority providers require the renewal of all their issued certificates at once without advance notice. That means servers and resources have to use compromised certificates until the engineers can complete the process.<\/p>\n \u201cRecently within Microsoft Digital, we had to renew more than 2,000 certificates across the teams,\u201d Gajarla says. \u201cSome teams had immense workloads to get this done.\u201d<\/p>\n Timely certificate renewals are not just for servers used in development, they are essential to daily operations at Microsoft.<\/p>\n \u201cIf a certificate renewal isn\u2019t taken care of on time, it will quickly escalate to leadership,\u201d Sayal says. \u201cWe need certificates to be current to stay compliant and avoid fire-fighting at the last minute.\u201d<\/p>\n Verify that a certificate is the best solution<\/strong><\/p>\n The first step is making sure that a digital certificate is the right approach.<\/p>\n \u201cWe should check why we are using the certificate,\u201d Gajarla says. \u201cIs there any modern way we can integrate the services without one?\u201d<\/p>\n The answer is often yes.<\/p>\n After Gajarla\u2019s difficulty gaining physical access to an asset with an expiring certificate, the team began exploring ways to optimize certificate management. Along the way, they found that sometimes a machine-specific certificate isn\u2019t needed at all.<\/p>\n \u201cI recommend using Azure managed certificates for Azure Front Door, Azure Key Vault, Azure Content Delivery Network (CDN), and Azure App Services, included in every Azure subscription,\u201d Gajarla says. \u201cManaged certificates eliminate the need to physically touch a machine to handle routine certificate operations.\u201d<\/p>\n In the past, Microsoft Digital used connection strings and shared access signature (SAS) tokens known as Secrets to access services and storage. To maintain the authorized connection string, Secrets must be renewed every three months which took hundreds of hours each year.<\/p>\n Now the team takes every opportunity to avoid certificates, connection strings, and SAS tokens from the beginning. Instead, Microsoft Digital uses managed identities for Microsoft Azure resources and other new Microsoft Azure services to protect servers and resources.<\/p>\n Another approach is to add encryption when the data is at rest or in transit using Microsoft Azure service managed keys<\/a>, which reduces risk and lessens the need to own and manage digital certificates.<\/p>\n \u201cInvestigate whether you really need a certificate,\u201d Sayal says. \u201cWith the modern world that Azure offers, you don\u2019t need them as often.\u201d<\/p>\n Automation and operations with Microsoft Azure<\/strong><\/p>\n Gajarla discovered several certificate management best practices including a technique called \u2018touchless certificate management\u2019 that uses Microsoft Azure Key Vault. \u201cThis Azure service is the main driver of automation,\u201d Gajarla says. \u201cIt connects to the certificate providers and automatically renews them.\u201d<\/p>\n Now that the process is automated, I didn\u2019t even notice that I needed to renew my certificates. It saves me the time it would have taken to deal with them and lets me focus on my current tasks.<\/p>\n – Dennis Han, software engineer, Microsoft Finance<\/p>\n<\/blockquote>\n \u201cEven with custom domain endpoint, you can use the automation options provided by Key Vault,\u201d Gajarla says. \u201cThis integrates well with third-party certificate providers. It\u2019s the most efficient way to create, roll over, and renew certificates.\u201d<\/p>\n Touchless certificates are not associated with an individual machine. \u201cIt\u2019s not a reactive, but a proactive approach,\u201d Sayal says.<\/p>\n Developer Dennis Han, a software engineer in Microsoft Finance, is already benefiting from the new Microsoft Digital practices. \u201cNow that the process is automated, I didn\u2019t even notice that I needed to renew my certificates,\u201d Han says. \u201cIt saves me the time it would have taken to deal with them and lets me focus on my current tasks.\u201d<\/p>\n Han also finds that the new system is better for security in addition to ease of certificate maintenance. \u201cIt enables business functionality rather than requiring me to spend time managing infrastructure,\u201d Han says.<\/p>\n Likewise, Gajarla has seen a time savings for engineering across the board. Teams are still rolling out the new practices. \u201cSome teams have 100% adoption while a few have legacy systems and are still in the process,\u201d Gajarla says.<\/p>\n The benefits are already clear.<\/p>\n \u201cNow each service has its own identity, not tied to a machine,\u201d Gajarla says. “Senior leadership doesn\u2019t have to monitor what certificates are expiring or follow up with their teams anymore.”<\/p>\n Sayal has noticed a difference as well.<\/p>\n \u201cNow everything is done proactively,\u201d Sayal says. \u201cNow everyone can focus on their best work.\u201d<\/p>\n See how Microsoft Azure Front Door makes it easy for two apps to boost availability and security.<\/a><\/p>\n Find out what Microsoft learned from applying Zero Trust principles during COVID-19.<\/a><\/p>\n