Skip to content

Commit 7bf1bfa

Browse files
halkazwinihalkazwini
committed
remove tls 1.0 and 1.1
1 parent c42ef52 commit 7bf1bfa

File tree

2 files changed

+34
-37
lines changed

2 files changed

+34
-37
lines changed

‎articles/frontdoor/standard-premium/tls-policy-configure.md

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
---
2-
title: Configure Azure Front Door TLS Policy
2+
title: Configure Azure Front Door TLS Policy (preview)
33
description: This article shows you how you can configure TLS policy to meet security requirements for your Front Door custom domains.
44
author: halkazwini
55
ms.author: halkazwini
66
ms.service: azure-frontdoor
77
ms.topic: how-to
8-
ms.date: 03/16/2025
8+
ms.date: 03/18/2025
99
---
1010

1111
# How to configure TLS policy on a Front Door custom domain onboarded on Front Door
@@ -44,5 +44,6 @@ If you're using Azure to host your [DNS domains](/azure/dns/dns-overview), you m
4444

4545
## Related content
4646

47-
Learn how to [Add a custom domain on Azure Front Door](how-to-add-custom-domain.md)
48-
Learn how to [Configure HTTPS for your custom domain on Azure Front Door](how-to-configure-https-custom-domain.md)
47+
- [Azure Front Door TLS Policy (preview)](tls-policy.md)
48+
- [Add a custom domain on Azure Front Door](how-to-add-custom-domain.md)
49+
- [Configure HTTPS for your custom domain on Azure Front Door](how-to-configure-https-custom-domain.md)

‎articles/frontdoor/standard-premium/tls-policy.md

Lines changed: 29 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,30 @@
11
---
2-
title: Azure Front Door TLS Policy
2+
title: Azure Front Door TLS Policy (preview)
33
description: Learn how custom TLS policies help you meet security requirements for your Azure Front Door custom domains.
44
author: halkazwini
55
ms.author: halkazwini
66
ms.service: azure-frontdoor
77
ms.topic: concept-article
8-
ms.date: 03/16/2025
8+
ms.date: 03/18/2025
99
---
1010

1111
# Azure Front Door TLS policy
1212

1313
Azure Front Door supports [end-to-end TLS encryption](../end-to-end-tls.md). When you add a custom domain to Azure Front Door, HTTPS is required, and you need to define a TLS policy which includes control of the TLS protocol version as well as the cipher suites and the order in which ciphers are used during a TLS handshake.
1414

15-
Azure Front Door supports four versions of the TLS protocol: TLS versions 1.0, 1.1, 1.2 and 1.3. Although TLS 1.2 introduced client/mutual authentication in RFC 5246, Azure Front Door currently doesn't support client/mutual authentication (mTLS).
15+
Azure Front Door supports two versions of the TLS protocol: TLS versions 1.2 and 1.3. Although TLS 1.2 introduced client/mutual authentication in RFC 5246, Azure Front Door currently doesn't support client/mutual authentication (mTLS).
1616

1717
Azure Front Door offers two mechanisms for controlling TLS policy. You can use either a predefined policy or a custom policy per your own needs.
1818

1919
- Azure Front Door offers several predefined TLS policies. You can configure your AFD with any of these policies to get the appropriate level of security. These predefined policies are configured keeping in mind the best practices and recommendations from the Microsoft Security team. We recommend that you use the newest TLS policies to ensure the best TLS security.
2020
- If a TLS policy needs to be configured for your own business and security requirements, you can use a Custom TLS policy. With a custom TLS policy, you have complete control over the minimum TLS protocol version to support, and the supported cipher suites.
2121

22-
For minimum TLS version 1.2, the negotiation will attempt to establish TLS 1.3 and then TLS 1.2, while for minimum TLS version 1.0 all four versions will be attempted. The client must support at least one of the supported ciphers to establish an HTTPS connection with Azure Front Door. Azure Front Door chooses a cipher in the listed order from the client-supported ciphers.
22+
For minimum TLS version 1.2, the negotiation will attempt to establish TLS 1.3 and then TLS 1.2. The client must support at least one of the supported ciphers to establish an HTTPS connection with Azure Front Door. Azure Front Door chooses a cipher in the listed order from the client-supported ciphers.
2323

24-
When Azure Front Door initiates TLS traffic to the origin, it will attempt to negotiate the best TLS version that the origin can reliably and consistently accept. Supported TLS versions for origin connections are TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3.
24+
When Azure Front Door initiates TLS traffic to the origin, it will attempt to negotiate the best TLS version that the origin can reliably and consistently accept. Supported TLS versions for origin connections are TLS 1.2, and TLS 1.3.
2525

2626
> [!NOTE]
27-
> - TLS 1.0/1.1 will be deprecated by March 1, 2025. From now on to March 1, 2025, you can't change TLS versions to use TLS 1.0/1.1. Switch to TLS 1.2 before March 1, 2025.
28-
> - Clients with TLS 1.3 enabled are required to support one of the Microsoft SDL compliant EC Curves, including Secp384r1, Secp256r1, and Secp521, in order to successfully make requests with Azure Front Door using TLS 1.3. It's recommended that clients use one of these curves as their preferred curve during requests to avoid increased TLS handshake latency, which may result from multiple round trips to negotiate the supported EC curve.
27+
> Clients with TLS 1.3 enabled are required to support one of the Microsoft SDL compliant EC Curves, including Secp384r1, Secp256r1, and Secp521, in order to successfully make requests with Azure Front Door using TLS 1.3. It's recommended that clients use one of these curves as their preferred curve during requests to avoid increased TLS handshake latency, which may result from multiple round trips to negotiate the supported EC curve.
2928
3029
## Predefined TLS policy
3130

@@ -35,29 +34,29 @@ The following table shows the list of cipher suites and minimum protocol version
3534

3635
By default, TLSv1.2_2023 will be selected. TLSv1.2_2022 maps to the minimum TLS 1.2 version in previous design, while TLSv1.1/1.0_2019 maps to minimum TLS 1.0/1.1 in previous design.
3736

38-
| **OpenSSL** | **Cipher** **Suite** | **TLSv1.2_2023** | **TLSv1.2_2022** | **TLSv1.1/1.0_2019 (To deprecate)** |
39-
|---|---|---|---|---|
40-
| **Min. Protocol version** | | **1.2** | **1.2** | **1.1/1.0** |
41-
| **Supported Protocols** | | **1.3/1.2** | **1.3./1.2** | **1.3/1.2/1.1/1.0** |
42-
| **min TLS1.3** | | | | |
43-
| **TLS_AES_256_GCM_SHA384** | TLS_AES_256_GCM_SHA384 | Yes | Yes | Yes |
44-
| **TLS_AES_128_GCM_SHA256** | TLS_AES_128_GCM_SHA256 | Yes | Yes | Yes |
45-
| **min TLS1.2** | | | | |
46-
| **ECDHE-RSA-AES256-GCM-SHA384** | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | Yes | Yes | Yes |
47-
| **ECDHE-RSA-AES128-GCM-SHA256** | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | Yes | Yes | Yes |
48-
| **AES256-GCM-SHA384** | TLS_RSA_WITH_AES_256_GCM_SHA384 | | Yes | Yes |
49-
| **AES128-GCM-SHA256** | TLS_RSA_WITH_AES_128_GCM_SHA256 | | Yes | Yes |
50-
| **AES256-SHA256** | TLS_RSA_WITH_AES_256_CBC_SHA256 | | Yes | Yes |
51-
| **AES128-SHA256** | TLS_RSA_WITH_AES_128_CBC_SHA256 | | Yes | Yes |
52-
| **DHE-RSA-AES256-GCM-SHA384** | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | | Yes | Yes |
53-
| **DHE-RSA-AES128-GCM-SHA256** | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | | Yes | Yes |
54-
| **ECDHE-RSA-AES256-SHA384** | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | | Yes | Yes |
55-
| **ECDHE-RSA-AES128-SHA256** | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | | Yes | Yes |
56-
| **min TLSv1.1/1.0** | | | | |
57-
| **ECDHE-RSA-AES256-SHA** | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | | | yes |
58-
| **ECDHE-RSA-AES128-SHA** | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | | | yes |
59-
| **AES256-SHA** | TLS_RSA_WITH_AES_256_CBC_SHA | | | yes |
60-
| **AES128-SHA** | TLS_RSA_WITH_AES_128_CBC_SHA | | | yes |
37+
| **OpenSSL** | **Cipher** **Suite** | **TLSv1.2_2023** | **TLSv1.2_2022** |
38+
|---|---|---|---|
39+
| **Min. Protocol version** | | **1.2** | **1.2** |
40+
| **Supported Protocols** | | **1.3/1.2** | **1.3./1.2** |
41+
| **min TLS1.3** | | | |
42+
| **TLS_AES_256_GCM_SHA384** | TLS_AES_256_GCM_SHA384 | Yes | Yes |
43+
| **TLS_AES_128_GCM_SHA256** | TLS_AES_128_GCM_SHA256 | Yes | Yes |
44+
| **min TLS1.2** | | | |
45+
| **ECDHE-RSA-AES256-GCM-SHA384** | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 | Yes | Yes |
46+
| **ECDHE-RSA-AES128-GCM-SHA256** | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 | Yes | Yes |
47+
| **AES256-GCM-SHA384** | TLS_RSA_WITH_AES_256_GCM_SHA384 | | Yes |
48+
| **AES128-GCM-SHA256** | TLS_RSA_WITH_AES_128_GCM_SHA256 | | Yes |
49+
| **AES256-SHA256** | TLS_RSA_WITH_AES_256_CBC_SHA256 | | Yes |
50+
| **AES128-SHA256** | TLS_RSA_WITH_AES_128_CBC_SHA256 | | Yes |
51+
| **DHE-RSA-AES256-GCM-SHA384** | TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | | Yes |
52+
| **DHE-RSA-AES128-GCM-SHA256** | TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | | Yes |
53+
| **ECDHE-RSA-AES256-SHA384** | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 | | Yes |
54+
| **ECDHE-RSA-AES128-SHA256** | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | | Yes |
55+
| **min TLSv1.1/1.0** | | | |
56+
| **ECDHE-RSA-AES256-SHA** | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | | |
57+
| **ECDHE-RSA-AES128-SHA** | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | | |
58+
| **AES256-SHA** | TLS_RSA_WITH_AES_256_CBC_SHA | | |
59+
| **AES128-SHA** | TLS_RSA_WITH_AES_128_CBC_SHA | | |
6160

6261
## Custom TLS policy
6362

@@ -94,6 +93,3 @@ Azure Front Door supports the following cipher suites from which you can choose
9493

9594
> [!div class="nextstepaction"]
9695
> [Configure TLS policy on Front Door](tls-policy-configure.md).
97-
98-
99-

0 commit comments

Comments
 (0)