You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Learn how SSL and TLS work in Azure App Service, including TLS version support, certificate management, secure bindings, and mutual authentication to protect web app traffic.
> The [retirement of TLS 1.1 and 1.0 on Azure services](https://azure.microsoft.com/updates/azure-support-tls-will-end-by-31-october-2024-2/) doesn't affect applications running on App Service, Azure Functions, or Logic Apps (Standard). Applications on either App Service, Azure Functions, or Logic Apps (Standard) configured to accept TLS 1.0 or TLS 1.1 for incoming requests **will continue to run unaffected**.
16
17
17
-
Transport Layer Security (TLS) is a widely adopted security protocol designed to secure connections and communications between servers and clients. App Service allows customers to use TLS/SSL certificates to secure incoming requests to their web apps. App Service currently supports different set of TLS features for customers to secure their web apps.
18
+
Transport Layer Security (TLS) is a widely adopted security protocol designed to secure connections and communications between servers and clients. App Service allows customers to use TLS/SSL certificates to secure incoming requests to their web apps. App Service currently supports different set of TLS features for customers to secure their web apps.
19
+
20
+
Azure App Service supports TLS to ensure:
21
+
22
+
-**Encryption** of data in transit.
23
+
-**Authentication** of web apps using trusted certificates.
24
+
-**Integrity** to prevent tampering of data during transmission.
18
25
19
26
> [!TIP]
20
27
>
21
-
> You can also ask Azure Copilot these questions:
28
+
> You can also ask Azure Copilot, an AI-powered assistant in the Azure portal, these questions:
22
29
>
23
30
> -*What versions of TLS are supported in App Service?*
24
31
> -*What are the benefits of using TLS 1.3 over previous versions?*
25
32
> -*How can I change the cipher suite order for my App Service Environment?*
26
33
>
27
34
> To find Azure Copilot, on the [Azure portal](https://portal.azure.com) toolbar, select **Copilot**.
28
35
29
-
## Supported TLS Version on App Service?
36
+
## TLS version support
30
37
31
-
For incoming requests to your web app, App Service supports TLS versions 1.0, 1.1, 1.2, and 1.3.
38
+
Azure App Service supports the following TLS versions for incoming requests to your web app:
32
39
33
-
### Set Minimum TLS Version
34
-
Follow these steps to change the Minimum TLS version of your App Service resource:
35
-
1. Browse to your app in the [Azure portal](https://portal.azure.com/)
36
-
1. In the left menu, select **configuration** and then select the **General settings** tab.
37
-
1. On __Minimum Inbound TLS Version__, using the dropdown, select your desired version.
38
-
1. Select **Save** to save the changes.
40
+
-**TLS 1.3** — Latest and most secure version, now fully supported.
41
+
-**TLS 1.2** — Default minimum TLS version for new web apps.
42
+
-**TLS 1.1 and TLS 1.0** — Supported for backward compatibility, but not recommended.
39
43
40
-
### Minimum TLS Version with Azure Policy
44
+
You can configure the **minimum TLS version** for incoming requests to your web app and its SCM site. By default, the minimum is set to **TLS 1.2**.
41
45
42
-
You can use Azure Policy to help audit your resources when it comes to minimum TLS version. You can refer to [App Service apps should use the latest TLS version policy definition](https://ms.portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ff0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b) and change the values to your desired minimum TLS version. For similar policy definitions for other App Service resources, refer to [List of built-in policy definitions - Azure Policy for App Service](../governance/policy/samples/built-in-policies.md#app-service).
46
+
You can use Azure Policy to help audit your resources when it comes to minimum TLS version. You can refer to [App Service apps should use the latest TLS version policy definition](https://ms.portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ff0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b) and change the values to your desired minimum TLS version. For similar policy definitions for other App Service resources, refer to [List of built-in policy definitions - Azure Policy for App Service](../governance/policy/samples/built-in-policies.md#app-service).
43
47
44
-
### Minimum TLS Version and SCM Minimum TLS Version
48
+
### TLS 1.3
45
49
46
-
App Service also allows you to set minimum TLS version for incoming requests to your web app and to SCM site. By default, the minimum TLS version for incoming requests to your web app and to SCM is set to 1.2 on both portal and API.
50
+
TLS 1.3 is fully supported on App Service and introduces several improvements over TLS 1.2:
47
51
48
-
### TLS 1.3
52
+
-**Stronger security** with simplified cipher suites and forward secrecy.
53
+
-**Faster handshakes** for reduced latency.
54
+
-**Encrypted handshake** messages for enhanced privacy.
49
55
50
-
TLS 1.3 is the latest and most secure TLS version supported on Azure App Service. It introduces significant security and performance improvements over TLS 1.2 by simplifying cryptographic algorithms, reducing handshake latency, and enhancing encryption.
56
+
To require TLS 1.3 for all inbound requests, set your **Minimum Inbound TLS Version** to **TLS 1.3** in the Azure portal, CLI, or ARM templates.
51
57
52
-
Key benefits include:
53
-
-**Stronger Security**: Removes outdated cipher suites, enforces Perfect Forward Secrecy (PFS), and encrypts more of the handshake process.
54
-
-**Faster Handshake**: Reduces round trips, improving connection latency, especially for repeated sessions (0-RTT support).
55
-
-**Better Performance**: Uses streamlined encryption algorithms that lower computational overhead and improve efficiency.
TLS 1.3 supports the following cipher suites, which are fixed and cannot be customized:
57
59
58
-
#### Cipher Suites
59
-
A [Minimum TLS Cipher Suite](#minimum-tls-cipher-suite) setting is available with TLS 1.3. This includes two cipher suites at the top of the cipher suite order:
60
-
- TLS_AES_256_GCM_SHA384
61
-
- TLS_AES_128_GCM_SHA256
60
+
-`TLS_AES_256_GCM_SHA384`
61
+
-`TLS_AES_128_GCM_SHA256`
62
62
63
-
Since TLS 1.3 removes legacy cryptographic algorithms, it's recommended for applications that require modern security standards, improved performance, and reduced latency.
63
+
These suites provide strong encryption and are automatically used when TLS 1.3 is negotiated.
64
64
65
65
### TLS 1.2
66
66
67
-
TLS 1.2 is the default TLS version for Azure App Service. It provides strong encryption, improved security over older versions, and compliance with industry standards such as PCI DSS. Since TLS 1.2 is the default, no action is required unless you are migrating from an older TLS version. If your app currently uses TLS 1.0 or 1.1, updating to TLS 1.2 is recommended to maintain security, performance, and compliance. Azure App Service supports a predefined set of TLS 1.2 cipher suites to ensure secure communication between clients and your web app.
67
+
TLS 1.2 is the **default and recommended**TLS version for App Service. It provides strong encryption and broad compatibility while meeting compliance standards like PCI DSS. New web apps and SCM endpoints are automatically set to TLS 1.2 unless changed.
68
68
69
-
### TLS 1.0 and 1.1
69
+
Azure App Service uses a secure set of TLS 1.2 cipher suites to ensure encrypted connections and protect against known vulnerabilities. While TLS 1.0 and 1.1 can be enabled for backward compatibility, they are not recommended.
70
70
71
-
TLS 1.0 and 1.1 are considered legacy protocols and are no longer considered secure. It's recommended for customers to use TLS 1.2 or above as the minimum TLS version. When creating a web app, the default minimum TLS version is TLS 1.2.
71
+
### TLS 1.0 and TLS 1.1
72
72
73
-
To ensure backward compatibility for TLS 1.0 and TLS 1.1, App Service will continue to support TLS 1.0 and 1.1 for incoming requests to your web app. However, since the default minimum TLS version is set to TLS 1.2, you need to update the minimum TLS version configurations on your web app to either TLS 1.0 or 1.1 so the requests won't be rejected.
73
+
TLS 1.0 and 1.1 are considered **legacy protocols** and are no longer considered secure. They are supported on App Service only for backward compatibility and should be avoided when possible. The default minimum TLS version for new apps is **TLS 1.2**, and we recommend migrating apps that still use TLS 1.0 or 1.1.
74
74
75
75
> [!IMPORTANT]
76
76
> Incoming requests to web apps and incoming requests to Azure are treated differently. App Service will continue to support TLS 1.0 and 1.1 for incoming requests to the web apps. For incoming requests directly to the Azure control plane, for example through ARM or API calls, it's not recommended to use TLS 1.0 or 1.1.
77
-
>
78
77
79
78
## Minimum TLS cipher suite
80
79
@@ -83,17 +82,101 @@ To ensure backward compatibility for TLS 1.0 and TLS 1.1, App Service will conti
83
82
84
83
The minimum TLS cipher suite includes a fixed list of cipher suites with an optimal priority order that you cannot change. Reordering or reprioritizing the cipher suites isn't recommended as it could expose your web apps to weaker encryption. You also cannot add new or different cipher suites to this list. When you select a minimum cipher suite, the system automatically disables all less secure cipher suites for your web app, without allowing you to selectively disable only some weaker cipher suites.
85
84
86
-
### What are cipher suites and how do they work on App Service?
85
+
### What are cipher suites and how do they work on App Service?
87
86
88
-
A cipher suite is a set of instructions that contains algorithms and protocols to help secure network connections between clients and servers. By default, the front-end's OS would pick the most secure cipher suite that is supported by both App Service and the client. However, if the client only supports weak cipher suites, then the front-end's OS would end up picking a weak cipher suite that is supported by them both. If your organization has restrictions on what cipher suites should not be allowed, you may update your web app’s minimum TLS cipher suite property to ensure that the weak cipher suites would be disabled for your web app.
87
+
A cipher suite is a set of instructions that contains algorithms and protocols to help secure network connections between clients and servers. By default, the front-end's OS would pick the most secure cipher suite that is supported by both App Service and the client. However, if the client only supports weak cipher suites, then the front-end's OS would end up picking a weak cipher suite that is supported by them both. If your organization has restrictions on what cipher suites should not be allowed, you may update your web app’s minimum TLS cipher suite property to ensure that the weak cipher suites would be disabled for your web app.
89
88
90
89
### App Service Environment (ASE) V3 with cluster setting `FrontEndSSLCipherSuiteOrder`
91
90
92
-
For App Service Environments with `FrontEndSSLCipherSuiteOrder` cluster setting, you need to update your settings to include two TLS 1.3 cipher suites (TLS_AES_256_GCM_SHA384 and TLS_AES_128_GCM_SHA256). Once updated, restart your front-end for the change to take effect. You must still include the two required cipher suites as mentioned in the docs.
91
+
For App Service Environments (ASE) with the `FrontEndSSLCipherSuiteOrder` cluster setting configured, you need to update your settings to include **the two TLS 1.3 cipher suites**:
92
+
93
+
-`TLS_AES_256_GCM_SHA384`
94
+
-`TLS_AES_128_GCM_SHA256`
95
+
96
+
Once you update your cluster setting, **you must restart your front-end** for the changes to take effect. Also, remember that **you must still include the two required cipher suites as mentioned in the documentation**, even when updating to support TLS 1.3. If you are already using `FrontEndSSLCipherSuiteOrder`, it is **not recommended to also enable Minimum TLS Cipher Suite for your web app**, as this could lead to conflicting configurations. **Only one** of these should be configured for managing cipher suite preferences.
97
+
98
+
## End-to-end TLS encryption
99
+
100
+
End-to-end (E2E) TLS encryption ensures that **front-end to worker communication** within Azure App Service is encrypted using TLS. Without this feature, while incoming HTTPS requests are encrypted to the front ends, the traffic from front ends to workers running the application workloads would travel unencrypted inside Azure’s infrastructure.
101
+
102
+
E2E TLS helps ensure **full encryption of traffic** between:
103
+
104
+
- Clients and App Service front ends.
105
+
- App Service front ends and worker processes hosting the application.
106
+
107
+
This feature is available on:
108
+
109
+
-**Premium App Service plans** (recommended for new deployments).
110
+
-**Legacy Standard App Service plans** (existing users).
111
+
112
+
> [!IMPORTANT]
113
+
> **Premium plans** are recommended for new deployments that require end-to-end encryption and other advanced security features.
114
+
115
+
### How to enable end-to-end TLS encryption
116
+
117
+
You can enable E2E TLS encryption via:
118
+
119
+
-**Azure portal** settings.
120
+
-**Azure CLI** commands.
121
+
-**ARM templates** for automation.
122
+
123
+
Once enabled, all intra-cluster communication for your web app will be encrypted using TLS, ensuring **end-to-end data protection**.
124
+
125
+
## SSL/TLS certificates on App Service
93
126
94
-
## End-to-end TLS Encryption
127
+
To serve HTTPS traffic, App Service requires an SSL/TLS certificate bound to your custom domain.
95
128
96
-
End-to-end (E2E) TLS encryption is available in Premium App Service plans (and legacy Standard App Service plans). Front-end intra-cluster traffic between App Service front-ends and the workers running application workloads can now be encrypted.
129
+
### Types of certificates
130
+
131
+
-**App Service Certificates (ASC)**
132
+
Fully managed certificates issued and renewed automatically by Azure, stored securely in Azure Key Vault.
133
+
134
+
-**Bring your own certificate (BYOC)**
135
+
Upload and manage certificates (PFX format) issued by third-party Certificate Authorities (CAs).
136
+
137
+
### Binding certificates to custom domains
138
+
139
+
After uploading or creating a certificate, you bind it to a custom domain on your web app using:
140
+
141
+
-**SNI SSL bindings** for multitenant hosting.
142
+
-**IP SSL bindings** for dedicated IP addresses.
143
+
144
+
> [!NOTE]
145
+
> Azure-managed domains (such as `*.azurewebsites.net`) are automatically secured with default certificates, requiring no additional configuration.
146
+
147
+
## Mutual TLS (mTLS) authentication
148
+
149
+
Azure App Service supports **mutual TLS (mTLS)** on **both Linux and Windows App Service plans**, allowing apps to require client certificates for added security.
150
+
151
+
### How mTLS works
152
+
153
+
- Clients present certificates that are validated against a trusted CA chain you configure.
154
+
- Only clients with valid certificates can connect.
155
+
- Commonly used to secure APIs and internal apps.
156
+
157
+
### Configuration options
158
+
159
+
- Enable mTLS through **Azure portal**, **CLI**, or **ARM templates**.
160
+
- Upload trusted CA certificates for client validation.
161
+
- Access client certificate information in app code via request headers.
162
+
163
+
## Automatic certificate management
164
+
165
+
Azure App Service provides built-in features to manage certificates automatically:
166
+
167
+
-**App Service managed certificates (free)**
168
+
Automatically issued and renewed for custom domains. These certificates are limited to basic domain validation and don't support wildcard or exportable certificates.
169
+
170
+
-**App Service Certificates (paid)**
171
+
Fully managed certificates that support advanced scenarios, including wildcard domains and exportable certificates. These are stored and managed in Azure Key Vault.
172
+
173
+
## Summary
174
+
175
+
Azure App Service makes it easy to secure your web apps with SSL/TLS. With support for modern TLS versions, flexible certificate options, and advanced features like mutual TLS, App Service helps you protect data in transit and meet compliance requirements.
97
176
98
177
## Next steps
99
-
*[Secure a custom DNS name with a TLS/SSL binding](configure-ssl-bindings.md)
178
+
179
+
-[Bind SSL certificates to your custom domain](configure-ssl-bindings.md)
180
+
-[Purchase and manage App Service Certificates](configure-ssl-app-service-certificate.md)
0 commit comments