App Service should require client certificates

Medium Azure General webapp-app-service-require-client

Applies to

Microsoft.Web/sites

What CGPulse checks

A resource passes this rule when clientCertEnabled must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Enable client certificate authentication to enforce mutual TLS for all connections. In Azure Portal: App Service > Configuration > General settings > Client certificate mode > Require. See: https://learn.microsoft.com/en-us/azure/app-service/app-service-web-configure-tls-mutual-auth

Careful: Clients without valid certificates will be rejected. Only enable if mutual TLS is required

CLI

az webapp update --ids "{id}" --set clientCertEnabled=true clientCertMode=Required

Terraform

resource "azurerm_linux_web_app" "{name}" {
  name                = "{name}"
  resource_group_name = "{rg}"
  location            = var.location
  service_plan_id     = azurerm_service_plan.{name}.id
  client_certificate_enabled = true
  client_certificate_mode    = "Required"
  site_config {}
}

Compliance frameworks

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan