Azure Cache for Redis TLS: Upcoming migration to DigiCert Global G2 CA Root

This blog contains important information about TLS certificate changes for Azure Cache for Redis endpoints that may impact client connectivity.  

In 2020, most Azure services were updated to use TLS certificates from Certificate Authorities (CAs) that chain up to the DigiCert Global G2 root. However, Azure Cache for Redis, remained on TLS certificates issued by the Baltimore CyberTrust Root. Because the current Baltimore CyberTrust Root will expire in May 2025, now is the time for Azure Cache for Redis to switch to the DigiCert Global G2 CA Root*. The migration will start in May 2022, and finish by the end of June 2022 for public Azure cloud. For Azure Government regions, the migration is expected to start in July 2022, and complete by end of July 2022.

We expect that most Azure Cache for Redis customers will not be impacted; however, your application may be impacted if you explicitly specify a list of acceptable CAs (a practice known as “certificate pinning”). This change is limited to the public Azure cloud and Azure Government cloud. There are no changes in Azure sovereign cloud offerings.

If any of your client applications are pinned to the root CA Baltimore CyberTrust Root or current intermediate CAs listed in the table below, immediate action is required to prevent disruption to connectivity to Azure Cache for Redis.  

* Other Azure service TLS certificates may be issued by a different PKI. *

Overview of Action Required

• If your client application has pinned to the Baltimore CyberTrust Root CA, in addition to Baltimore, add the DigiCert Global Root G2 to your trusted root store before May 2022. 
• If your client application has pinned to the intermediate CAs, in addition to Microsoft RSA TLS CAs, add the Microsoft Azure TLS Issuing CAs to your trusted root store before May 2022. 
• Keep using the current root or intermediate CAs in your applications or devices until the transition period is completed (necessary to prevent connection interruption).  

How to check if your client application is affected

Check if your application has pinned to  

• Root CA: Baltimore CyberTrust Root CA or,  
• Intermediate CA: Microsoft RSA TLS CA 01 
• Intermediate CA: Microsoft RSA TLS CA 02 

Search your source code for the thumbprint, Common Name, and other cert properties of any of the root CA or intermediate CAs. If there is a match, then your application will be impacted, immediate action is required.

Some more ways to detect if your application is affected as described here: Azure TLS Certificate Changes | Microsoft Docs

Action required 

1. To continue without disruption due to this change, Microsoft recommends that, in addition to Baltimore, client applications or devices trust the root CA – DigiCert Global Root G2: 

DigiCert Global Root G2 
(Thumbprint: df3c24f9bfd666761b268073fe06d1cc8d4f82a4) 

Intermediate certificates are expected to change more frequently than the root CAs. Customers who use certificate pinning are recommended to not take dependencies on them and instead pin to the root certificate as it rolls less frequently.  

2.  To prevent future disruption, you should also add the following roots to the trusted store. This will save you from the allowlist effort in near future if you add the recommended root CAs now: 

• DigiCert Global Root G3 
  (Thumbprint: 7e04de896a3e666d00e687d33ffad93be83d349e) 
• Microsoft RSA Root Certificate Authority 2017 
  (Thumbprint: 73a5e64a3bff8316ff0edccc618a906e4eae4d74) 
• Microsoft ECC Root Certificate Authority 2017 
  (Thumbprint: 999a64c37ff47d9fab95f14769891460eec4c3c5) 

3. If you are currently pinning to the intermediate CAs and have a requirement to continue pinning to intermediate CAs, to prevent future disruption, you should also add the intermediate Microsoft Azure ECC TLS CAs listed in the table below to the trusted store.

List of possible Root CAs is available here: Azure TLS Certificate Changes | Microsoft Docs

Support

If you have any questions, get answers from community experts in Microsoft Q&A. If you have completed step 1 and need technical help, please open a support request with the options below and a member from our engineering team will get back to you. 

• For Issue type, select Technical.
• For Subscription, select your subscription. 
• For Service, select My Services, then select Cache for Redis.
• For Resource, select your resource. 
• For Problem type, select Availability, Connectivity and Timeouts. 
• For Problem subtype, select Connection Error. 

Certificate Renewal Summary 

The table below provides information about the certificates that are being rolled out. Depending on which certificate your service uses for establishing TLS connections, action may be needed to prevent loss of connectivity.