Skip to content

Commit 09377b2

Browse files
halkazwinihalkazwini
committed
draft article
1 parent fd86075 commit 09377b2

File tree

2 files changed

+147
-0
lines changed

2 files changed

+147
-0
lines changed

‎articles/frontdoor/standard-premium/tls-policy-configure.md

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
---
2+
title: Configure Azure Front Door TLS Policy
3+
description: This article shows you how you can configure TLS policy to meet security requirements for your Front Door custom domains.
4+
author: halkazwini
5+
ms.author: halkazwini
6+
ms.service: azure-frontdoor
7+
ms.topic: how-to
8+
ms.date: 03/16/2025
9+
---
10+
11+
# How to configure TLS policy on a Front Door custom domain onboarded on Front Door
12+
13+
Azure Front Door offers two mechanisms for controlling TLS policy. You can use either a predefined policy or a custom policy per your own needs.
14+
15+
- Azure Front Door offers several predefined TLS policies. You can configure your AFD with any of these policies to get the appropriate level of security. These predefined policies are configured keeping in mind the best practices and recommendations from the Microsoft Security team. We recommend that you use the newest TLS policies to ensure the best TLS security.
16+
17+
- If a TLS policy needs to be configured for your own business and security requirements, you can use a Custom TLS policy. With a custom TLS policy, you have complete control over the minimum TLS protocol version to support, as well as the supported cipher suites.
18+
19+
In this document, you will learn how to configure TLS policy on a Front Door custom domain.
20+
21+
## Prerequisites
22+
23+
Before you can complete the steps in this tutorial, you must first create a Front Door. For more information, see [Quickstart: Create a Front Door](/azure/frontdoor/quickstart-create-front-door).
24+
25+
If you don't already have a custom domain, you must first purchase one with a domain provider. For example, see [Buy a custom domain name](/azure/app-service/manage-custom-dns-buy-domain).
26+
27+
If you're using Azure to host your [DNS domains](/azure/dns/dns-overview), you must delegate the domain provider's domain name system (DNS) to an Azure DNS. For more information, see [Delegate a domain to Azure DNS](/azure/dns/dns-delegate-domain-azure-dns). Otherwise, if you're using a domain provider to handle your DNS domain, continue to [Create a CNAME DNS record](/azure/frontdoor/front-door-custom-domain).
28+
29+
## Configure TLS policy
30+
31+
1. Under **Settings**, select **Domains** for your Azure Front Door profile. Then select **+** **Add** to add a new domain.
32+
33+
2. On the Add a domain pane, follow [How to add a custom domain - Azure Front Door | Microsoft Learn](/azure/frontdoor/standard-premium/how-to-add-custom-domain) and [Configure HTTPS for your custom domain - Azure Front Door | Microsoft Learn](/azure/frontdoor/standard-premium/how-to-configure-https-custom-domain) to configure the following information.
34+
35+
3. For **TLS policy**, choose the predefined policy from the dropdown listor Custom to customize the cipher suites per your needs. You can also view the supported cipher suites by clicking **View policy details**. When you choose **Custom**, you can choose the Minimum TLS version and the corresponding cipher suites.
36+
37+
> [!NOTE]
38+
> You can reuse the custom TLS policy setting from other domains in portal by selecting the domain in **Reuse setting from other domain**.
39+
40+
## Verify TLS policy configurations
41+
42+
1. Once the custom domain with TLS policy is deployed successfully, you can test it in your browser.
43+
1. View the supported cipher suit of your domain via <https://www.ssllabs.com/ssltest/analyze.html?d=p2c1test.bugbash.dev.azfdtest.xyz&latest> or use the sslscan tool.
44+
45+
## Related content
46+
47+
Learn how to [Add a custom domain on Azure Front Door](how-to-add-custom-domain.md)
48+
Learn how to [Configure HTTPS for your custom domain on Azure Front Door](how-to-configure-https-custom-domain.md)

‎articles/frontdoor/standard-premium/tls-policy.md

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
---
2+
title: Azure Front Door TLS Policy
3+
description: Learn how custom TLS policies help you meet security requirements for your Azure Front Door custom domains.
4+
author: halkazwini
5+
ms.author: halkazwini
6+
ms.service: azure-frontdoor
7+
ms.topic: concept-article
8+
ms.date: 03/16/2025
9+
---
10+
11+
# Azure Front Door TLS policy
12+
13+
Azure Front Door supports [end-to-end TLS encryption](end-to-end-tls.md). When you add a custom domain to Azure Front Door, HTTPS is required, and you need to define a TLS policy which includes control of the TLS protocol version as well as the cipher suites and the order in which ciphers are used during a TLS handshake.
14+
15+
Azure Front Door supports four versions of the TLS protocol: TLS versions 1.0, 1.1, 1.2 and 1.3. Although TLS 1.2 introduced client/mutual authentication in RFC 5246, Azure Front Door currently doesn't support client/mutual authentication (mTLS).
16+
17+
Azure Front Door offers two mechanisms for controlling TLS policy. You can use either a predefined policy or a custom policy per your own needs.
18+
19+
- Azure Front Door offers several predefined TLS policies. You can configure your AFD with any of these policies to get the appropriate level of security. These predefined policies are configured keeping in mind the best practices and recommendations from the Microsoft Security team. We recommend that you use the newest TLS policies to ensure the best TLS security.
20+
- If a TLS policy needs to be configured for your own business and security requirements, you can use a Custom TLS policy. With a custom TLS policy, you have complete control over the minimum TLS protocol version to support, and the supported cipher suites.
21+
22+
For minimum TLS version 1.2, the negotiation will attempt to establish TLS 1.3 and then TLS 1.2, while for minimum TLS version 1.0 all four versions will be attempted. The client must support at least one of the supported ciphers to establish an HTTPS connection with Azure Front Door. Azure Front Door chooses a cipher in the listed order from the client-supported ciphers.
23+
24+
When Azure Front Door initiates TLS traffic to the origin, it will attempt to negotiate the best TLS version that the origin can reliably and consistently accept. Supported TLS versions for origin connections are TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3.
25+
26+
> [!NOTE]
27+
> - TLS 1.0/1.1 will be deprecated by March 1, 2025. From now on to March 1, 2025, you can't change TLS versions to use TLS 1.0/1.1. Switch to TLS 1.2 before March 1, 2025.
28+
> - Clients with TLS 1.3 enabled are required to support one of the Microsoft SDL compliant EC Curves, including Secp384r1, Secp256r1, and Secp521, in order to successfully make requests with Azure Front Door using TLS 1.3. It's recommended that clients use one of these curves as their preferred curve during requests to avoid increased TLS handshake latency, which may result from multiple round trips to negotiate the supported EC curve.
29+
30+
## Predefined TLS policy
31+
32+
Azure Front Door offers several predefined TLS policies. You can configure your AFD with any of these policies to get the appropriate level of security. The policy names are annotated by the minimum TLS versions and the year in which they were configured (TLSv1.2_2023>). Each policy offers different TLS protocol versions and/or cipher suites. These predefined policies are configured keeping in mind the best practices and recommendations from the Microsoft Security team. We recommend that you use the newest TLS policies to ensure the best TLS security.
33+
34+
The following table shows the list of cipher suites and minimum protocol version support for each predefined policy. The ordering of the cipher suites determines the priority order during TLS negotiation.
35+
36+
By default, TLSv1.2_2023 will be selected. TLSv1.2_2022 maps to the minimum TLS 1.2 version in previous design, while TLSv1.1/1.0_2019 maps to minimum TLS 1.0/1.1 in previous design.
37+
38+
| **OpenSSL** | **Cipher** **Suite** | **TLSv1.2_2023** | **TLSv1.2_2022** | **TLSv1.1/1.0_2019 (To deprecate)** |
39+
|---|---|---|---|---|
40+
| **Min. Protocol version** | | **1.2** | **1.2** | **1.1/1.0** |
41+
| **Supported Protocols** | | **1.3/1.2** | **1.3./1.2** | **1.3/1.2/1.1/1.0** |
42+
| **min TLS1.3** | | | | |
43+
| **TLS_AES_256_GCM_SHA384** | TLS_AES_256_GCM_SHA384 | Yes | Yes | Yes |
44+
| **TLS_AES_128_GCM_SHA256** | TLS_AES_128_GCM_SHA256 | Yes | Yes | Yes |
45+
| **min TLS1.2** | | | | |
46+
| **ECDHE-RSA-AES256-GCM-SHA384** | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | Yes | Yes | Yes |
47+
| **ECDHE-RSA-AES128-GCM-SHA256** | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | Yes | Yes | Yes |
48+
| **AES256-GCM-SHA384** | TLS_RSA_WITH_AES_256_GCM_SHA384 | | Yes | Yes |
49+
| **AES128-GCM-SHA256** | TLS_RSA_WITH_AES_128_GCM_SHA256 | | Yes | Yes |
50+
| **AES256-SHA256** | TLS_RSA_WITH_AES_256_CBC_SHA256 | | Yes | Yes |
51+
| **AES128-SHA256** | TLS_RSA_WITH_AES_128_CBC_SHA256 | | Yes | Yes |
52+
| **DHE-RSA-AES256-GCM-SHA384** | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | | Yes | Yes |
53+
| **DHE-RSA-AES128-GCM-SHA256** | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | | Yes | Yes |
54+
| **ECDHE-RSA-AES256-SHA384** | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | | Yes | Yes |
55+
| **ECDHE-RSA-AES128-SHA256** | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | | Yes | Yes |
56+
| **min TLSv1.1/1.0** | | | | |
57+
| **ECDHE-RSA-AES256-SHA** | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | | | yes |
58+
| **ECDHE-RSA-AES128-SHA** | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | | | yes |
59+
| **AES256-SHA** | TLS_RSA_WITH_AES_256_CBC_SHA | | | yes |
60+
| **AES128-SHA** | TLS_RSA_WITH_AES_128_CBC_SHA | | | yes |
61+
62+
## Custom TLS policy
63+
64+
If a TLS policy needs to be configured for your requirements, you can use a Custom TLS policy. With a custom TLS policy, you have complete control over the minimum TLS protocol version to support, and the supported cipher suites and their priority order.
65+
66+
> [!NOTE]
67+
> TLS 1.3 is always enabled no matter what minimum version is enabled.
68+
69+
### Cipher suites
70+
71+
Azure Front Door supports the following cipher suites from which you can choose your custom policy. The ordering of the cipher suites determines the priority order during TLS negotiation.
72+
73+
- TLS_AES_256_GCM_SHA384 (TLS 1.3 only)
74+
- TLS_AES_128_GCM_SHA256 (TLS 1.3 only)
75+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
76+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
77+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
78+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
79+
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
80+
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
81+
- TLS_RSA_WITH_AES_256_GCM_SHA384
82+
- TLS_RSA_WITH_AES_128_GCM_SHA256
83+
- TLS_RSA_WITH_AES_256_CBC_SHA256
84+
- TLS_RSA_WITH_AES_128_CBC_SHA256
85+
- TLS_RSA_WITH_AES_256_CBC_SHA
86+
- TLS_RSA_WITH_AES_128_CBC_SHA
87+
- TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
88+
- TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
89+
90+
> [!NOTE]
91+
> For Windows 10 and later versions, we recommend enabling one or both of the ECDHE_GCM cipher suites for better security. Windows 8.1, 8, and 7 aren't compatible with these ECDHE_GCM cipher suites. The ECDHE_CBC and DHE cipher suites have been provided for compatibility with those operating systems.
92+
93+
## Next step
94+
95+
> [!div class="nextstepaction"]
96+
> [Configure TLS policy on Front Door](tls-policy-configure.md).
97+
98+
99+

0 commit comments

Comments
 (0)