EIDFED-002: Federation Signing Certificate Validity Period
- Platform
- Entra ID / M365
- Category
- Entra ID Federation & Hybrid Identity
- Severity
- High
- Zero Trust pillar
- Identity (weight 2)
- Golden fixtures
- 2
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Federation signing certificates with excessively long validity periods provide an extended window for attackers who obtain the private key to forge SAML tokens and maintain persistent unauthorized access. Certificates with validity periods exceeding 3 years deviate from security best practices and may indicate a compromised or attacker-created certificate. Short-lived certificates limit the duration of potential abuse if the private key is compromised.
Recommended value
Federation signing certificates with validity periods no longer than 1 year with automated rotation procedures in place
Remediation
Review the signing certificates for all federated domains and check their NotBefore and NotAfter dates to determine the validity period. Replace any certificates with validity periods exceeding 3 years with new certificates using shorter lifetimes aligned with organizational certificate policy. Implement automated certificate rotation procedures and configure monitoring alerts for certificates approaching expiration.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- IA-5(2)
- MITRE ATT&CK
- T1556.006