|
| 1 | +--- |
| 2 | +title: Azure Front Door TLS policy (preview) |
| 3 | +description: Learn how custom TLS policies help you meet security requirements for your Azure Front Door custom domains. |
| 4 | +author: halkazwini |
| 5 | +ms.author: halkazwini |
| 6 | +ms.service: azure-frontdoor |
| 7 | +ms.topic: concept-article |
| 8 | +ms.date: 03/26/2025 |
| 9 | +--- |
| 10 | + |
| 11 | +# Azure Front Door TLS policy (preview) |
| 12 | + |
| 13 | +> [!IMPORTANT] |
| 14 | +> TLS policy is currently in PREVIEW. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability. |
| 15 | +
|
| 16 | +Azure Front Door supports [end-to-end TLS encryption](../end-to-end-tls.md). When you add a custom domain to Azure Front Door, HTTPS is required, and you need to define a TLS policy which includes control of the TLS protocol version and the cipher suites during a TLS handshake. |
| 17 | + |
| 18 | +Azure Front Door supports two versions of the TLS protocol: TLS versions 1.2 and 1.3. Currently, Azure Front Door doesn't support client/mutual authentication (mTLS). |
| 19 | + |
| 20 | +> [!NOTE] |
| 21 | +> As of March 1, 2025, TLS 1.0 and 1.1 are disallowed on Azure Front Door. If you didn't disable TLS 1.0 and 1.1 on legacy settings before this date, they'll still work temporarily but will be disabled in April 2025. |
| 22 | +
|
| 23 | +Azure Front Door Standard and Premium offer two mechanisms for controlling TLS policy. You can use either a predefined policy or a custom policy per your own needs. If you use Azure Front Door (classic) and Microsoft CDN (classic), you'll continue to use the minimum TLS 1.2 version. |
| 24 | + |
| 25 | +- Azure Front Door offers several predefined TLS policies. You can configure your AFD with any of these policies to get the appropriate level of security. These predefined policies are configured keeping in mind the best practices and recommendations from the Microsoft Security team. We recommend that you use the newest TLS policies to ensure the best TLS security. |
| 26 | +- If a TLS policy needs to be configured for your own business and security requirements, you can use a Custom TLS policy. With a custom TLS policy, you have complete control over the minimum TLS protocol version to support, and the supported cipher suites. |
| 27 | + |
| 28 | +For a minimum TLS version 1.2, the negotiation will attempt to establish TLS 1.3 and then TLS 1.2. The client must support at least one of the supported ciphers to establish an HTTPS connection with Azure Front Door. Azure Front Door chooses a cipher in the listed order from the client-supported ciphers. |
| 29 | + |
| 30 | +When Azure Front Door initiates TLS traffic to the origin, it will attempt to negotiate the best TLS version that the origin can reliably and consistently accept. Supported TLS versions for origin connections are TLS 1.2, and TLS 1.3. |
| 31 | + |
| 32 | +> [!NOTE] |
| 33 | +> Clients with TLS 1.3 enabled are required to support one of the Microsoft SDL compliant EC Curves, including Secp384r1, Secp256r1, and Secp521, in order to successfully make requests with Azure Front Door using TLS 1.3. It's recommended that clients use one of these curves as their preferred curve during requests to avoid increased TLS handshake latency, which may result from multiple round trips to negotiate the supported EC curve. |
| 34 | +
|
| 35 | +## Predefined TLS policy |
| 36 | + |
| 37 | +Azure Front Door offers several predefined TLS policies. You can configure your AFD with any of these policies to get the appropriate level of security. The policy names are annotated by the minimum TLS versions and the year in which they were configured (TLSv1.2_2023>). Each policy offers different TLS protocol versions and/or cipher suites. These predefined policies are configured keeping in mind the best practices and recommendations from the Microsoft Security team. We recommend that you use the newest TLS policies to ensure the best TLS security. |
| 38 | + |
| 39 | +The following table shows the list of cipher suites and minimum protocol version support for each predefined policy. The ordering of the cipher suites determines the priority order during TLS negotiation. |
| 40 | + |
| 41 | +By default, TLSv1.2_2023 will be selected. TLSv1.2_2022 maps to the minimum TLS 1.2 version in previous design. Some might see a read-only TLSv1.0/1.1_2019 which maps to the minimum TLS 1.0/1.1 version in previous design, because they don't specifically switch to minimum TLS 1.2 version. The TLSv1.0/1.1_2019 policy for such will be removed and disabled in April 2025. |
| 42 | + |
| 43 | +| **OpenSSL** | **Cipher** **Suite** | **TLSv1.2_2023** | **TLSv1.2_2022** | |
| 44 | +|---|---|---|---| |
| 45 | +| **Minimum Protocol version** | | **1.2** | **1.2** | |
| 46 | +| **Supported Protocols** | | **1.3/1.2** | **1.3./1.2** | |
| 47 | +| **TLS_AES_256_GCM_SHA384** | TLS_AES_256_GCM_SHA384 | Yes | Yes | |
| 48 | +| **TLS_AES_128_GCM_SHA256** | TLS_AES_128_GCM_SHA256 | Yes | Yes | |
| 49 | +| **ECDHE-RSA-AES256-GCM-SHA384** | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | Yes | Yes | |
| 50 | +| **ECDHE-RSA-AES128-GCM-SHA256** | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | Yes | Yes | |
| 51 | +| **DHE-RSA-AES256-GCM-SHA384** | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | | Yes | |
| 52 | +| **DHE-RSA-AES128-GCM-SHA256** | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | | Yes | |
| 53 | +| **ECDHE-RSA-AES256-SHA384** | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | | Yes | |
| 54 | +| **ECDHE-RSA-AES128-SHA256** | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | | Yes | |
| 55 | + |
| 56 | +## Custom TLS policy |
| 57 | + |
| 58 | +If a TLS policy needs to be configured for your requirements, you can use a Custom TLS policy. With a custom TLS policy, you have complete control over the minimum TLS protocol version to support, and the supported cipher suites and their priority order. |
| 59 | + |
| 60 | +> [!NOTE] |
| 61 | +> TLS 1.3 is always enabled no matter what minimum version is enabled. |
| 62 | +
|
| 63 | +### Cipher suites |
| 64 | + |
| 65 | +Azure Front Door supports the following cipher suites from which you can choose your custom policy. The ordering of the cipher suites determines the priority order during TLS negotiation. |
| 66 | + |
| 67 | +- TLS_AES_256_GCM_SHA384 (TLS 1.3 only) |
| 68 | +- TLS_AES_128_GCM_SHA256 (TLS 1.3 only) |
| 69 | +- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 |
| 70 | +- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 |
| 71 | +- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 |
| 72 | +- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 |
| 73 | +- TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 |
| 74 | +- TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 |
| 75 | + |
| 76 | +> [!NOTE] |
| 77 | +> For Windows 10 and later versions, we recommend enabling one or both of the ECDHE_GCM cipher suites for better security. Windows 8.1, 8, and 7 aren't compatible with these ECDHE_GCM cipher suites. The ECDHE_CBC and DHE cipher suites have been provided for compatibility with those operating systems. |
| 78 | +
|
| 79 | +## Next step |
| 80 | + |
| 81 | +> [!div class="nextstepaction"] |
| 82 | +> [Configure TLS policy on Front Door](tls-policy-configure.md) |
0 commit comments