Support for legacy TLS protocols and cipher suites in Azure Offerings

This article is contributed. See the original author and article here.

Overview

 

Microsoft Azure services already operate in TLS 1.2-only mode. There are a limited number of services that still allow TLS 1.0 and 1.1 to support customers with legacy needs.  For customers who use services that still support legacy protocol versions and must meet compliance requirements, we have provided instructions on how to ensure legacy protocols and cipher suites are not negotiated. For example, HDInsight provides the minSupportedTlsVersion property as part of the Resource Manager template.  This property supports three values: “1.0”, “1.1” and “1.2”, which correspond to TLS 1.0+, TLS 1.1+ and TLS 1.2+ respectively.  Customers can set the allowed minimum version for their HDInsight resource.

 

This document presents the latest information on TLS protocols and cipher suite support with links to relevant documentation for Azure Offerings.  For offerings that still allow legacy protocols to support customers with legacy needs, TLS 1.2 is still preferred.  The documentation links explain what needs to be done to ensure TLS 1.2 is preferred in all scenarios.

 

Documentation Links

 

Azure Offering	TLS documentation
API Management	https://docs.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers
App Service	https://docs.microsoft.com/azure/app-service/configure-ssl-bindings https://docs.microsoft.com/azure/app-service/deploy-staging-slots
Application Gateway	https://docs.microsoft.com/azure/application-gateway/application-gateway-ssl-policy-overview https://docs.microsoft.com/azure/application-gateway/application-gateway-configure-ssl-policy-powershell
Azure App Service – Azure Arc	https://docs.microsoft.com/azure/app-service/configure-ssl-bindings https://docs.microsoft.com/azure/app-service/deploy-staging-slots
Azure App Service Static Web Apps	https://docs.microsoft.com/azure/app-service/configure-ssl-bindings https://docs.microsoft.com/azure/app-service/deploy-staging-slots
Azure Cognitive Search	https://docs.microsoft.com/azure/search/search-security-overview
Azure Cosmos DB	https://devblogs.microsoft.com/cosmosdb/tls-1-2-enforcement/
Azure Database for MariaDB	https://docs.microsoft.com/azure/mariadb/concepts-ssl-connection-security#tls-enforcement-in-azure-database-for-mariadb https://docs.microsoft.com/azure/azure-sql/database/connectivity-settings#minimal-tls-version
Azure Database for MySQL	https://docs.microsoft.com/azure/mysql/concepts-ssl-connection-security#tls-enforcement-in-azure-database-for-mysql https://docs.microsoft.com/azure/azure-sql/database/connectivity-settings#minimal-tls-version
Azure Database for PostgreSQL	Single Server – https://docs.microsoft.com/azure/postgresql/concepts-ssl-connection-security   Flexible Server – https://docs.microsoft.com/azure/postgresql/flexible-server/how-to-connect-tls-ssl https://docs.microsoft.com/azure/azure-sql/database/connectivity-settings#minimal-tls-version
Azure Front Door / Azure Front Door X	https://docs.microsoft.com/azure/frontdoor/standard-premium/faq
Azure SQL	https://docs.microsoft.com/azure/azure-sql/database/connectivity-settings#minimal-tls-version
Azure SQL Database Edge	https://docs.microsoft.com/azure/azure-sql/database/connectivity-settings#minimal-tls-version
Azure Synapse Analytics	https://docs.microsoft.com/azure/azure-sql/database/connectivity-settings#minimal-tls-version
Azure Web Application Firewall	https://docs.microsoft.com/azure/application-gateway/application-gateway-ssl-policy-overview https://docs.microsoft.com/azure/application-gateway/application-gateway-configure-ssl-policy-powershell https://docs.microsoft.com/azure/frontdoor/standard-premium/faq
Cloud Services	https://docs.microsoft.com/azure/cloud-services/applications-dont-support-tls-1-2
Common Data Service	https://docs.microsoft.com/power-platform/admin/server-cipher-tls-requirements https://docs.microsoft.com/power-platform/important-changes-coming#tls-rsa-cipher-suites-are-deprecated
Dynamics 365 AI Customer Insights	https://docs.microsoft.com/azure/search/search-security-overview https://docs.microsoft.com/powerapps/maker/portals/faq https://azure.microsoft.com/updates/power-bi-support-for-transportlayer-security/ https://docs.microsoft.com/azure/hdinsight/transport-layer-security https://devblogs.microsoft.com/cosmosdb/tls-1-2-enforcement/ https://docs.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version?tabs=portal https://docs.microsoft.com/security/benchmark/azure/baselines/service-fabric-security-baseline#44-encrypt-all-sensitive-information-in-transit https://github.com/Azure/Service-Fabric-Troubleshooting-Guides/blob/master/Security/TLS%20Configuration.md
Dynamics 365 Fraud Protection	https://azure.microsoft.com/updates/power-bi-support-for-transportlayer-security/
Event Grid	https://docs.microsoft.com/security/benchmark/azure/baselines/event-grid-security-baseline
Event Hubs	https://support.microsoft.com/topic/add-support-for-tls-1-1-and-tls-1-2-on-service-bus-for-windows-server-1-1-92a6cf2c-1b3f-1ea6-185a-b9ced2840fb6
Functions	https://docs.microsoft.com/azure/app-service/configure-ssl-bindings https://docs.microsoft.com/azure/app-service/deploy-staging-slots
HDInsight	https://docs.microsoft.com/azure/hdinsight/transport-layer-security
IoT Hub	https://docs.microsoft.com/azure/iot-hub/iot-hub-tls-support
Key Vault	https://docs.microsoft.com/azure/key-vault/general/security-features#tls-and-https
Logic Apps	https://docs.microsoft.com/azure/logic-apps/logic-apps-securing-a-logic-app?tabs=azure-portal https://docs.microsoft.com/azure/logic-apps/logic-apps-securing-a-logic-app?tabs=azure-portal
Microsoft Azure Managed Instance for Apache Cassandra	https://devblogs.microsoft.com/cosmosdb/tls-1-2-enforcement/
Microsoft Forms Pro	https://docs.microsoft.com/power-platform/important-changes-coming#tls-rsa-cipher-suites-are-deprecated https://docs.microsoft.com/power-platform/admin/server-cipher-tls-requirements
Notification Hubs	https://support.microsoft.com/topic/add-support-for-tls-1-1-and-tls-1-2-on-service-bus-for-windows-server-1-1-92a6cf2c-1b3f-1ea6-185a-b9ced2840fb6 https://docs.microsoft.com/azure/notification-hubs/notification-hubs-tls12
Power Apps	https://docs.microsoft.com/powerapps/maker/portals/faq   https://social.technet.microsoft.com/Forums/92811d44-1165-4da2-96e7-20dc99bdf718/can-power-query-be-updated-to-use-tls-version-12?forum=powerquery https://azure.microsoft.com/updates/power-bi-support-for-transportlayer-security/ https://docs.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers
Power Automate	https://docs.microsoft.com/power-platform/admin/wp-compliance-data-privacy#data-protection https://docs.microsoft.com/powerapps/maker/portals/faq https://social.technet.microsoft.com/Forums/92811d44-1165-4da2-96e7-20dc99bdf718/can-power-query-be-updated-to-use-tls-version-12?forum=powerquery https://azure.microsoft.com/updates/power-bi-support-for-transportlayer-security/ https://docs.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers https://docs.microsoft.com/azure/logic-apps/logic-apps-securing-a-logic-app?tabs=azure-portal
Power BI	https://azure.microsoft.com/updates/power-bi-support-for-transportlayer-security/
Power BI Embedded	https://azure.microsoft.com/updates/power-bi-support-for-transportlayer-security/
Service Bus	https://support.microsoft.com/topic/add-support-for-tls-1-1-and-tls-1-2-on-service-bus-for-windows-server-1-1-92a6cf2c-1b3f-1ea6-185a-b9ced2840fb6
Service Fabric	https://docs.microsoft.com/security/benchmark/azure/baselines/service-fabric-security-baseline#44-encrypt-all-sensitive-information-in-transit https://github.com/Azure/Service-Fabric-Troubleshooting-Guides/blob/master/Security/TLS%20Configuration.md
SQL Server Stretch Database	https://docs.microsoft.com/azure/azure-sql/database/connectivity-settings#minimal-tls-version
Storage	https://docs.microsoft.com/azure/storage/common/transport-layer-security-configure-minimum-version?tabs=portal https://docs.microsoft.com/azure/import-export/ https://azure.microsoft.com/updates/afstlssupport/
VPN Gateway	https://docs.microsoft.com/azure/vpn-gateway/vpn-gateway-vpn-faq#tls1

 

 

FAQ (Frequently Asked Questions)

 

What is meant by legacy protocols?

Legacy protocols are defined as anything lower than TLS 1.2. 

 

What is meant by legacy cipher suites?

Cipher suites that were considered safe in the past but are no longer strong enough or they PFS.  While these ciphers are considered legacy, they are still supported for some backward compatibility customer scenarios.

 

What is the Microsoft preferred cipher suite order?

 For legacy purposes, Windows supports a large list of ciphers by default.  For all Microsoft Windows Server versions (2016 and higher), the following ciphers are the preferred set of cipher suites. The preferred set of cipher suites is set by Microsoft’s security policy.  It should be noted that Microsoft Windows uses the IANA (Internet Assigned Numbers Authority) cipher suite notation.  This link shows the IANA to OpenSSL mapping.  It should be noted that Microsoft Windows uses the IANA (Internet Assigned Numbers Authority) cipher suite notation.  This link shows the IANA to OpenSSL mapping.

 

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

 

Why is ChaCha20-Poly1305  not included in the list of approved ciphers?

ChaCha20-Poly1305 PolyChacha ciphers are supported by Windows and can be enabled in scenarios where customers control the OS. 

 

Why are CBC ciphers included in the Microsoft preferred cipher suite order?

The default Windows image includes CBC ciphers.  However, there are no known vulnerabilities related to the CBC mode cipher suites.  We have mitigations for CBC side-channel attacks.

 

Microsoft’s preferred cipher suite order for Windows includes 128-bit ciphers. Is there an increased risk with using these ciphers?

AES-128 does not introduce any practical risk but different customers may have different preferences with regard to the minimum key lengths they are willing to negotiate. Our preferred order prioritizes AES-256 over AES-128.  In addition, customers can adjust the order using the TLS Cmdlets.  There is also a group policy option detailed in this article: Prioritizing Schannel Cipher Suites – Win32 apps | Microsoft Docs.

 

Thanks for reading!

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.