Menu
Ensure incoming client certificates are enabled and required (if in use)
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-azure-compute-2-2-11The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
Based on SOC occupation classification
Showing SKILL.md
| name | cis-azure-compute-2.2.11 |
| description | Ensure incoming client certificates are enabled and required (if in use) |
| category | cis-azure-compute |
| version | 2.0.0 |
| author | cyberstrike-official |
| tags | ["cis","azure","app-service","deployment-slots","client-certificates","mutual-tls","authentication"] |
| cis_id | 2.2.11 |
| cis_benchmark | CIS Microsoft Azure Compute Services Benchmark v2.0.0 |
| tech_stack | ["azure"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Client certificates allow for the deployment slot to request a certificate for incoming requests. Only clients that have a valid certificate will be able to reach the deployment slot.
The TLS mutual authentication technique in enterprise environments ensures the authenticity of clients to the server. If incoming client certificates are enabled, then only an authenticated client with valid certificates can access the deployment slot.
Utilizing and maintaining client certificates will require additional work to obtain and manage replacement and key rotation.
NOTE: This recommendation cannot be implemented if following the recommendation titled "Ensure 'HTTP Version' is set to '2.0' (if in use)." This recommendation should only be considered for scenarios where HTTP versions prior to 2.0 are required for a deployment slot, and mutual certificate authentication is desired for validating clients.
App Services.Deployment, click Deployment slots.Settings, click Configuration.General settings pane, under Incoming client certificates, ensure that Client certificate mode is set to Required.Run the following command to list apps:
az webapp list
For each app, run the following command to list deployment slots:
az webapp deployment slot list --resource-group <resource-group-name> --name <app-name>
For each deployment slot, ensure that clientCertEnabled is set to true, and clientCertMode is set to Required.
The clientCertEnabled property should be true and clientCertMode should be Required.
App Services.Deployment, click Deployment slots.Settings, click Configuration.General settings pane, under Incoming client certificates, set Client certificate mode to Required.Save.Continue.For each deployment slot requiring remediation, run the following command to enable and require incoming client certificates:
az resource update --resource-group <resource-group-name> --name <app-name>/slots/<deployment-slot-name> --resource-type "Microsoft.Web/sites" --set properties.clientCertEnabled=true --set properties.clientCertMode=Required
By default, incoming client certificates are disabled.
Level 2 | Automated