Microsoft Fixes Windows 11 Features Failing Due to Expired Certificate

Tech giant Microsoft fixed several Windows 11 features failing to load after an expired certificate was discovered. According to The Verge, some Windows 11 users could not open apps like the Snipping Tool, touch keyboard, or emoji panel since a certificate expired on October 31, 2021.

“We fixed a known issue that might prevent some users from opening or using certain built-in Windows apps or parts of some built-in apps. This issue occurs because of a Microsoft digital certificate that expired October 31, 2021,” says Brandon LeBlanc, a program manager for the Windows Insider team.

Most enterprises now manage thousands of certificates regularly in their network infrastructure. These certificates must be monitored, tracked, and renewed on time to avoid expensive application outages. However, the maintenance required is not the only challenge posed by the growing number of certificates – security is also a significant concern. 

The trust they represent can be misused by cybercriminals for phishing, making them a potential target for theft. This fuels the need for efficiently managing these SSL/TLS certificates and their keys. However, it extends beyond SSL/TLS certificates to include certificates that involve people, devices, and IoT systems. At the same time, taking into consideration an enterprises’ certificate volumes and issuance velocity is significant.

Unknown certificates pose significant security risks.

Most of the digital communication has now moved to secure channels and requires digital certificates. While getting a proper certificate involves time and money, technology allows us to create self-signed certificates for testing purposes. Anyone with great ease can generate these self-signed certificates. Third-party software may also come with temporary certificates installed. These temporary certificates are supposed to work for initial testing purposes and are meant to be replaced before being pushed to production.

However, many times because of a slip in the process, these temporary certificates make their way into the organization’s infrastructure without the knowledge of the team managing these certificates. While rogue, unknown, and unmanaged certificates often lead to unplanned application outages, they also serve as easy targets for hackers.

Gain complete visibility into your certificate infrastructure to minimize the risk of outages

Discovery – The most challenging part of mitigating a certificate-related issue is not identifying the certificate but often locating it on time. Similar to any application, a certificate does not reside on a single device. It is distributed across load balancers, firewalls, web servers, containers, and multicloud environments. It would help if you had a tool to automatically build an inventory that can discover certificates across all devices in the infrastructure, regardless of the certificate authority (CA) or device type. Information such as locations, associated applications, expiry dates, signatures, etc., should also be automatically captured. And, users need to schedule periodic discoveries to keep inventory updated with new information on undocumented and rogue certificates.

Ownership – One of the crucial aspects of certificate lifecycle management is delegating the management responsibility of certificates and keys, in other words, assigning certificate owners and approvers. The underlying intent of establishing an ownership and approval process is to ensure that only authorized personnel are allowed to make changes to the certificate infrastructure. This process eliminates the existence of undocumented or unapproved certificates with weak security standards, thereby mitigating the risk of a data breach. 

However, organizations employing manual processes store certificate ownership information in excel spreadsheets and databases along with other certificates and key-related information. Manually tracking assigned owners and approvers for thousands of interlinked certificates via spreadsheets becomes plain unreasonable and, not to mention, highly error-prone. 

Properly assigning certificate owners and escalations, designing an approval workflow, and creating a simplified certificate enrollment process is pivotal to successfully implementing a standardized certificate management system.

Validation – Rogue and non-compliant certificates often find their way into infrastructure through two primary avenues – uncontrolled certificate procurement and insufficient policy enforcement. Users must have the ability to validate certificates against known vulnerabilities and flag non-compliant certificates continuously. The tool should define business policies in the form of approved certificate authorities (CA), encryption algorithms, hashes, and people. Equally important is enforcing, validating, and reporting on them promptly to mitigate outages triggered by non-compliant certificates.

Lifecycle Management – With emerging technologies such as IoT and containers striving to deliver exceptional digital experiences, the significance of robust certificate lifecycle management cannot be overlooked. The CA and the end-device, the primary entities involved in certificate management, must integrate with the certificate management tool to simplify certificate enrollment and provisioning. End-to-end certificate lifecycle management actions like issuing, renewing, revoking, regenerating, reissuing, and deleting must be supported out-of-box for any CA/device. This should also involve minimal human intervention to avoid misconfigurations.

 DevOps Integration – As organizations move towards an infrastructure-as-a-code culture that is rife with rapid release cycles and continuous integration/ continuous delivery (CI/CD) practices, speed is always the top priority. This need for speed has inadvertently made it difficult for security teams to shift left and bake security right into the DevOps lifecycle. As DevOps grows increasingly multi-faceted with cloud deployments, containers, microservices, and several other open-source management tools—the risk of a cyberattack increases multifold. Mitigating this risk requires DevOps to align with cybersecurity. 

One of the pivotal and time-tested security measures enforced to secure the CI/CD pipeline is digital certificates. These certificates add a much-needed layer of security for DevOps by authenticating and securing all digital communication. Implementing a well-documented, policy-based, compliant certificate infrastructure for applications used in DevOps toolchains and containerized environments is key to making the most out of speed and agility without compromising on application security.

Auditing and Reporting – Certificates and their keys are essential for maintaining the sanctity of an enterprise’s digital trust.  Any tool you choose must provide your team with role-based access to your certificates. The tool should granularly limit the operations that each role can perform on a particular certificate or device. Create an audit trail system that logs every action taken by stakeholders in the hierarchy, along with a timestamp. Make sure critical events are automatically reported back to the respective certificate teams. Audit logs are immensely useful for determining the cause of certificate-related issues and for detecting policy violations.

Also important is setting up an automated alerting and reporting mechanism that sends periodic reports and notifications on the expiry, validity, and compliance status of certificates to the corresponding owners. This helps with in-time renewals and proactive resolution of certificate issues. 

Crypto-agility – Crypto-agility is the ability of a system to rapidly switch between cryptographic assets (algorithms, hashes, certificates, keys, etc.) in bulk without disrupting the rest of the system. This is critical because PKI is continually evolving, and so are threats. When a vulnerability in the system is discovered, it is in the PKI owner’s best interest to resolve it as soon as possible by updating all applicable crypto mechanisms across the board. However, this process may take months due to scattered, siloed, and non-centralized systems, a significantly large window during which the vulnerability can be exploited.

Organizations need to infuse PKI with a system of control that allows for accelerated manipulation of its constituent systems. This includes the ability to quickly rotate certificates, expedite the enrollment/renewal/revocation process with CAs, and rapidly switch out outdated algorithms and protocols with new ones.

The AppViewX Solution

The AppViewX Next-Gen Machine Identity Automation platform simplifies public key infrastructure (PKI) and certificate lifecycle management (CLM) operations to bring agility in teams so that they can focus on business innovation and growth. End-to-end automation of PKI and CLM processes eliminates manual delays and errors, reduces the operational burden, and makes the entire process agile.

With AppViewX CERT+, enterprises can quickly set up their internal root CA as well as issuing CAs without making any upfront investment in costly hardware or complicated processes, or cumbersome PKI operations. CLM in CERT+ simplifies all certificate operations between CA and applications where certificates are used.

Invest in a security solution that is automated, compliant, easy to deploy and manage, and integrates with your existing security strategy. Above all, it should simplify the business operations rather than make them complicated.