Back to Checks
azure

Web app requires incoming client certificates

app_client_certificates_on
Service: appSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:microsoft.web/sites/config

Azure App Service apps enforce mutual TLS when client certificate mode is set to Required, meaning every inbound request must present a valid client certificate that the app can validate.

Prowler logoProwlerprowler-provider-azure

Risk

Without mTLS, clients aren't cryptographically authenticated at the transport layer. Adversaries can reach endpoints using spoofed sources or stolen tokens, leading to unauthorized data access (confidentiality), request tampering (integrity), and automated abuse that degrades service (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks app_client_certificates_on

Recommendation

Set client certificate mode to Required and validate client certs in application logic (issuer, validity, revocation).

Enforce HTTPS only, avoid broad exclusion paths, and manage certs via a trusted CA with rotation and revocation. Apply least privilege and zero trust, layering with private access or IP restrictions as needed.

Remediation

CLI

az webapp update --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --set clientCertEnabled=true clientCertMode=Required

Terraform

# Require client certificates for the App Service (use azurerm_linux_web_app or azurerm_windows_web_app)
resource "azurerm_linux_web_app" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<example_location>"
  resource_group_name = "<example_resource_name>"
  service_plan_id     = "<example_resource_id>"

  client_certificate_enabled = true      # Critical: enables mutual TLS
  client_certificate_mode    = "Required" # Critical: enforces client certs (passes the check)

  site_config {}
}

NativeIaC

// Require client certificates for the web app
resource appService 'Microsoft.Web/sites@2022-03-01' = {
  name: '<example_resource_name>'
  location: '<example_location>'
  properties: {
    serverFarmId: '<example_resource_id>'
    clientCertEnabled: true   // Critical: enables mutual TLS
    clientCertMode: 'Required' // Critical: enforces client certs (passes the check)
  }
}

Other

1Open Azure Portal and go to App Services
2Select your web app
3Go to Configuration > General settings
4Under Client certificate mode, select Required
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.app.app_client import app_client


class app_client_certificates_on(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []

        for (
            subscription_id,
            apps,
        ) in app_client.apps.items():
            subscription_name = app_client.subscriptions.get(
                subscription_id, subscription_id
            )
            for app in apps.values():
                report = Check_Report_Azure(metadata=self.metadata(), resource=app)
                report.subscription = subscription_id
                report.status = "PASS"
                report.status_extended = f"Clients are required to present a certificate for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."

                if app.client_cert_mode != "Required":
                    report.status = "FAIL"
                    report.status_extended = f"Clients are not required to present a certificate for app '{app.name}' in subscription '{subscription_name} ({subscription_id})'."

                findings.append(report)

        return findings

References