Microsoft Exchange Admin Portal Goes Down Due to an Expired SSL Certificate

On May 23, 2021, a Sunday, Microsoft Exchange administrators woke up to warning messages on their browsers as they tried to access the Microsoft Exchange Admin Portal. The portal was rendered inaccessible with the message “Your connection is not private,” caused by an outage that was later traced back to an expired SSL certificate. According to Qualys SSL Labs, the certificate associated with the Exchange Admin Portal expired at 8 AM ET on Sunday, which oddly escaped Microsoft’s attention radar.

While Microsoft hustled to fix the issue, Twitterati were quick to catch up with the outage. One of the tweets read, “What’s going in with http://admin.exchange.microsoft.com? Did you guys really forget to renew a certificate?”. Microsoft responded to this tweet by stating that they had isolated the problem and were fixing it. In the interim, the company also directed users to the service health dashboard for additional details. Later, Microsoft renewed the failed certificate and brought back the portal alive within a short span of time.

Prima facie, the incident might come across as insignificant, given the consequences of the outage weren’t dire, except for a few hours of downtime (albeit, Gartner reports that the average cost of IT downtime is close to a whopping $5,600 per minute!). It might even be convenient to brush it aside as a minor operations malfunction. However, the big old security breaches of Equifax and SolarWinds, the consequences of which still hang heavy in the air, serve as stark reminders of what neglected certificate expirations can do. So, it is only fair to not overlook the huge security risk that Microsoft took by not renewing the associated certificate on time.

The dangers of neglecting certificate expirations

A digital certificate is an important variable defining today’s cybersecurity equation. It is the shield that protects systems and applications from being hacked or attacked. It is the identity that helps establish digital trust and enables secure communication. When a certificate expires, the device or application becomes untrusted by default. This, in turn, blocks users from accessing it, dealing a major blow to the business revenue and the brand reputation.

On the other hand, an expired certificate exposes applications, systems, and user communication to the public internet, letting malicious actors eavesdrop on unsuspecting users and launch man-in-the-middle attacks to steal valuable information. Spoof websites are also born out of expired certificates to lure unsuspecting users into sharing sensitive personal information. In a nutshell, an expired certificate taken advantage of by threat actors could quickly engulf the target organization in a colossal mess of financial loss, reputation damage, and legal liabilities.

Certificate expiration isn’t the problem in itself. It is, in fact, part of the regular process. Certificates are issued with an expiry date (which is growing shorter year on year) to prevent their cipher from being broken and compromising the systems and applications they protect. Organizations are expected to monitor certificates proactively and renew them before expiry to reassert their credibility as the rightful owners of the domain before the issuing Certificate Authority.

The actual problem stems from the inefficiency of certificate monitoring and management. Majority of organizations continue to manage their certificates manually even to this day. While some organizations use spreadsheets with macros, some use certificate monitoring tools that only alert security teams on impending expirations and do not renew the expiring certificates. With certificates exploding in every organization, manual management leads to untracked, orphaned certificates that will eventually expire, causing outages. As manual certificate renewal involves tedious and time-consuming procedures, renewals are delayed, plunging organizations into the risk of experiencing a security breach with every passing minute.

How should organizations prevent outages and minimize risks due to expired certificates?

The answer lies in Automation. Automating digital certificate processes such as discovery, enrollment, renewals, provisioning, and revocation helps eliminate human errors and negligence, which are the significant reasons behind certificate vulnerabilities. In the case of an approaching certificate expiration, a certificate lifecycle management tool with native automation automatically gets a certificate from the CA by generating a new CSR or using an old CSR and installs it on the endpoint. By ensuring certificates are up-to-date, the automation tool prevents arbitrary expirations and costly outages.

Another advantage of automating certificate management is the network-wide visibility it offers into the certificate infrastructure. Certificates are often distributed across load balancers, firewalls, web servers, containers, and multi-cloud environments. Mitigating a certificate-related issue requires IT teams to quickly identify and locate the certificate. Manual tracking with spreadsheets makes this particularly challenging. On the contrary, automation tools offer a centralized inventory system with information on certificates across all devices in the infrastructure, regardless of the Certificate Authority or device type. This helps with quick identification and location of rogue, unknown, and unmanaged certificates, expediting the remediation process.

IT teams can also greatly benefit from automation tools because of their self-service capabilities. This allows application and network teams to self-service certificate provisioning, renewal, and revocation to move fast in case of emergencies. Enforcing role-based access controls further helps IT teams ensure only authorized personnel have access to the certificate infrastructure to avoid mismanagement.

You’re only as strong as your weakest link

In recent times, the world has witnessed a long list of high-profile outages and data breaches that have highlighted, among other things, the importance of efficient and error-free certificate monitoring and management. The outbreak of the COVID-19 pandemic has led to a staggering 600% growth in the number of cyberattacks. Experts predict that a cyberattack incident will occur every 11 seconds in 2021, four times what it was in 2016 (every 40 seconds). With the cyber threat landscape evolving at such a precarious pace, it is vitally important for big-league enterprises, such as Microsoft, to lead by example and not risk a breach with an expired certificate.

About AppViewx CERT+

AppViewX CERT+ is a next-gen CLM tool that protects applications and endpoints by automating certificate lifecycle management. CERT+ offers complete visibility into the encryption key infrastructure, enabling enterprises to predict and prevent outages. It tracks certificates in real-time and provides a unified view of the statuses, endpoint locations, respective CAs, sends periodic alerts when a certificate nears its expiry, and also renews it automatically.

If you would like to go outage-free, try AppViewX CERT+ or Book a Demo.

The post Microsoft Exchange Admin Portal Goes Down Due to an Expired SSL Certificate appeared first on AppViewX.

*** This is a Security Bloggers Network syndicated blog from Blogs – AppViewX authored by Krupa Patil. Read the original post at: https://www.appviewx.com/blogs/microsoft-exchange-admin-portal-goes-down-due-to-an-expired-ssl-certificate/