You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Learn how SSL and TLS work in Azure App Service, including TLS version support, certificate management, secure bindings, and mutual authentication to protect web app traffic.
3
+
description: Learn how TLS and SSL work in Azure App Service, including TLS version support, certificate management, bindings, and mutual authentication to protect web app traffic.
> The [retirement of TLS 1.1 and 1.0 on Azure services](https://azure.microsoft.com/updates/azure-support-tls-will-end-by-31-october-2024-2/) doesn't affect applications running on App Service, Azure Functions, or Logic Apps (Standard). Applications on either App Service, Azure Functions, or Logic Apps (Standard) configured to accept TLS 1.0 or TLS 1.1 for incoming requests **will continue to run unaffected**.
16
+
> The [retirement of TLS 1.1 and TLS 1.0 on Azure services](https://azure.microsoft.com/updates/azure-support-tls-will-end-by-31-october-2024-2/) doesn't affect applications running on Azure App Service, Azure Functions, or Azure Logic Apps (Standard). Applications on App Service, Azure Functions, or Logic Apps (Standard) that are configured to accept TLS 1.1 or TLS 1.0 for incoming requests *continue to run unaffected*.
17
17
18
-
Transport Layer Security (TLS) is a widely adopted security protocol designed to secure connections and communications between servers and clients. App Service allows customers to use TLS/SSL certificates to secure incoming requests to their web apps. App Service currently supports different set of TLS features for customers to secure their web apps.
18
+
Transport Layer Security (TLS) is a widely adopted security protocol that is designed to secure connections and communications between servers and clients. In Azure App Service, you can use TLS and Secure Sockets Layer (SSL) certificates to help secure incoming requests in your web apps.
19
19
20
-
Azure App Service supports TLS to ensure:
20
+
App Service supports TLS to help ensure:
21
21
22
22
-**Encryption** of data in transit.
23
-
-**Authentication** of web apps using trusted certificates.
23
+
-**Authentication** of web apps by using trusted certificates.
24
24
-**Integrity** to prevent tampering of data during transmission.
25
25
26
26
> [!TIP]
27
27
>
28
28
> You can also ask Azure Copilot, an AI-powered assistant in the Azure portal, these questions:
29
29
>
30
30
> -*What versions of TLS are supported in App Service?*
31
-
> -*What are the benefits of using TLS 1.3 over previous versions?*
31
+
> -*What are the benefits of using TLS 1.3 instead of earlier versions?*
32
32
> -*How can I change the cipher suite order for my App Service Environment?*
33
33
>
34
-
> To find Azure Copilot, on the [Azure portal](https://portal.azure.com) toolbar, select **Copilot**.
34
+
> On the page header in the [Azure portal](https://portal.azure.com), select **Copilot**.
35
35
36
36
## TLS version support
37
37
38
38
Azure App Service supports the following TLS versions for incoming requests to your web app:
39
39
40
-
-**TLS 1.3**: Latest and most secure version, now fully supported.
41
-
-**TLS 1.2**: Default minimum TLS version for new web apps.
42
-
-**TLS 1.1 and TLS 1.0**: Supported for backward compatibility, but not recommended.
40
+
-**TLS 1.3**: The latest and most secure version, now fully supported.
41
+
-**TLS 1.2**: The default minimum TLS version for new web apps.
42
+
-**TLS 1.1 and TLS 1.0**: Versions supported for backward compatibility, but not recommended.
43
43
44
-
You can configure the **minimum TLS version** for incoming requests to your web app and its SCM site. By default, the minimum is set to **TLS 1.2**.
44
+
You can configure the *minimum TLS version* for incoming requests to your web app and its Source Control Manager (SCM) site. By default, the minimum is set to **TLS 1.2**.
45
45
46
-
You can use Azure Policy to help audit your resources when it comes to minimum TLS version. You can refer to [App Service apps should use the latest TLS version policy definition](https://ms.portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ff0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b) and change the values to your desired minimum TLS version. For similar policy definitions for other App Service resources, refer to[List of built-in policy definitions - Azure Policy for App Service](../governance/policy/samples/built-in-policies.md#app-service).
46
+
You can use Azure Policy to help audit your resources and minimum TLS version. Go to [App Service apps should use the latest TLS version policy definition](https://ms.portal.azure.com/#view/Microsoft_Azure_Policy/PolicyDetailBlade/definitionId/%2Fproviders%2FMicrosoft.Authorization%2FpolicyDefinitions%2Ff0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b) and change the values to the minimum TLS version you want your web apps to use. For related policy definitions for other App Service resources, see[List of built-in policy definitions - Azure Policy for App Service](../governance/policy/samples/built-in-policies.md#app-service).
47
47
48
48
### TLS 1.3
49
49
50
50
TLS 1.3 is fully supported on App Service and introduces several improvements over TLS 1.2:
51
51
52
-
-**Stronger security** with simplified cipher suites and forward secrecy.
52
+
-**Stronger security**, with simplified cipher suites and forward secrecy.
53
53
-**Faster handshakes** for reduced latency.
54
54
-**Encrypted handshake** messages for enhanced privacy.
55
55
56
-
To require TLS 1.3 for all inbound requests, set your **Minimum Inbound TLS Version** to **TLS 1.3** in the Azure portal, CLI, or ARM templates.
56
+
To require TLS 1.3 for all inbound requests, set **Minimum Inbound TLS Version** to **TLS 1.3** in the Azure portal, the Azure CLI, or your Azure Resource Manager template (ARM template).
57
57
58
-
TLS 1.3 supports the following cipher suites, which are fixed and cannot be customized:
58
+
TLS 1.3 supports the following cipher suites, which are fixed and can't be customized:
59
59
60
60
-`TLS_AES_256_GCM_SHA384`
61
61
-`TLS_AES_128_GCM_SHA256`
@@ -64,119 +64,115 @@ These suites provide strong encryption and are automatically used when TLS 1.3 i
64
64
65
65
### TLS 1.2
66
66
67
-
TLS 1.2 is the **default and recommended** TLS version for App Service. It provides strong encryption and broad compatibility while meeting compliance standards like PCI DSS. New web apps and SCM endpoints are automatically set to TLS 1.2 unless changed.
67
+
TLS 1.2 is the *default and recommended* TLS version for App Service. It provides strong encryption and broad compatibility while meeting compliance standards like the Payment Card Industry Data Security Standard (PCI DSS). New web apps and SCM endpoints by default use TLS 1.2 unless you change them.
68
68
69
-
Azure App Service uses a secure set of TLS 1.2 cipher suites to ensure encrypted connections and protect against known vulnerabilities. While TLS 1.0 and 1.1 can be enabled for backward compatibility, they are not recommended.
69
+
Azure App Service uses a secure set of TLS 1.2 cipher suites to help ensure encrypted connections and to protect against known vulnerabilities. Although you can enable TLS 1.1 and TLS 1.0 for backward compatibility, we recommend that you use a minimum version of TLS 1.2.
70
70
71
-
### TLS 1.0 and TLS 1.1
71
+
### TLS 1.1 and TLS 1.0
72
72
73
-
TLS 1.0 and TLS 1.1 are considered *legacy protocols* and are no longer considered secure. They are supported on App Service only for backward compatibility and should be avoided when possible. The default minimum TLS version for new apps is *TLS 1.2*, and we recommend that you migrate apps that still use TLS 1.0 or TLS 1.1.
73
+
TLS 1.1 and TLS 1.0 are considered *legacy protocols* and are no longer considered secure. These versions are supported on App Service *only* for backward compatibility and should be avoided when possible. The default minimum TLS version for new apps is TLS 1.2, and we recommend that you migrate apps that use TLS 1.1 or TLS 1.0.
74
74
75
75
> [!IMPORTANT]
76
-
> Incoming requests to web apps and incoming requests to Azure are treated differently. App Service continues to support TLS 1.0 and TLS 1.1 for incoming requests to the web apps. For incoming requests made directly to the Azure control plane, for example through Azure Resource Manager or API calls, we recommend that you don't use use TLS 1.0 or TLS 1.1.
76
+
> Incoming requests to web apps and incoming requests to Azure are handled differently. App Service continues to support TLS 1.1 and TLS 1.0 for incoming requests to web apps.
77
+
>
78
+
> For incoming requests made directly to the Azure control plane, for example, through Azure Resource Manager or API calls, we recommend that you don't use TLS 1.1 or TLS 1.0.
77
79
78
80
## Minimum TLS cipher suite
79
81
80
82
> [!NOTE]
81
-
> Minimum TLS Cipher Suiteis supported on Basic SKUs and higher on multitenant App Service.
83
+
> The **Minimum TLS Cipher Suite** setting is supported on Basic SKUs or higher on multitenant App Service.
82
84
83
-
The minimum TLS cipher suite includes a fixed list of cipher suites with an optimal priority order that you cannot change. Reordering or reprioritizing the cipher suites isn't recommended as it could expose your web apps to weaker encryption. You also cannot add new or different cipher suites to this list. When you select a minimum cipher suite, the system automatically disables all less secure cipher suites for your web app, without allowing you to selectively disable only some weaker cipher suites.
85
+
The minimum TLS cipher suite includes a fixed list of cipher suites with an optimal priority order that you can't change. Reordering or reprioritizing the cipher suites isn't recommended because it could expose your web apps to weaker encryption. You also can't add new or different cipher suites to this list. When you select a minimum cipher suite, the system automatically disables all less secure cipher suites for your web app. You can't selectively disable only some weaker cipher suites.
84
86
85
87
### What are cipher suites and how do they work on App Service?
86
88
87
-
A cipher suite is a set of instructions that contains algorithms and protocols to help secure network connections between clients and servers. By default, the front-end's OS would pick the most secure cipher suite that is supported by both App Service and the client. However, if the client only supports weak cipher suites, then the front-end's OS would end up picking a weak cipher suite that is supported by them both. If your organization has restrictions on what cipher suites should not be allowed, you may update your web app’s minimum TLS cipher suite property to ensure that the weak cipher suites would be disabled for your web app.
89
+
A cipher suite is a set of instructions that contains algorithms and protocols to help secure network connections between clients and servers. By default, the front-end OS chooses the most secure cipher suite that both App Service and the client support. However, if the client supports only weak cipher suites, the front-end OS would end up choosing a weak cipher suite. If your organization has restrictions on what cipher suites are allowed, you can update your web app’s minimum TLS cipher suite property to ensure that weak cipher suites are disabled for your web app.
88
90
89
-
### App Service Environment (ASE) V3 with cluster setting `FrontEndSSLCipherSuiteOrder`
91
+
### App Service Environment with cluster setting FrontEndSSLCipherSuiteOrder
90
92
91
-
For App Service Environments (ASE) with the `FrontEndSSLCipherSuiteOrder` cluster setting configured, you need to update your settings to include **the two TLS 1.3 cipher suites**:
93
+
For App Service Environments that have the `FrontEndSSLCipherSuiteOrder` cluster setting configured, update your settings to include *the two TLS 1.3 cipher suites*:
92
94
93
95
-`TLS_AES_256_GCM_SHA384`
94
96
-`TLS_AES_128_GCM_SHA256`
95
97
96
-
After you update your cluster setting, *you must restart your front end* for the changes to take effect. Also, remember that *you must still include the two required cipher suites as mentioned in the documentation*, even when you update to support TLS 1.3. If you already use `FrontEndSSLCipherSuiteOrder`, we *do not recommend that you also enable Minimum TLS Cipher Suite for your web app*. The result might be conflicting configurations. Configure *only one* of these options to manage cipher suite preferences.
98
+
After you update your cluster setting, you must restart your front end for the changes to take effect. Also, you must *still include the two required cipher suites* described earlier, even when you update to support TLS 1.3. If you already use `FrontEndSSLCipherSuiteOrder`, we recommend that you don't also enable **Minimum TLS Cipher Suite** for your web app. The result might be conflicting configurations. Configure *only one* of these options to manage cipher suite preferences.
97
99
98
100
## End-to-end TLS encryption
99
101
100
-
End-to-end (E2E) TLS encryption ensures that **front-end to worker communication** within Azure App Service is encrypted using TLS. Without this feature, while incoming HTTPS requests are encrypted to the front ends, the traffic from front ends to workers running the application workloads would travel unencrypted inside Azure’s infrastructure.
102
+
End-to-end (E2E) TLS encryption ensures that *front-end to worker communication* within Azure App Service is encrypted by using TLS. Without this feature, while incoming HTTPS requests are encrypted to the front ends, the traffic from front ends to workers running the application workloads would travel unencrypted inside Azure’s infrastructure.
101
103
102
-
E2E TLS helps ensure **full encryption of traffic** between:
104
+
E2E TLS helps ensure *full encryption of traffic* between:
103
105
104
106
- Clients and App Service front ends
105
107
- App Service front ends and worker processes hosting the application
106
108
107
109
This feature is available on:
108
110
109
-
-**Premium App Service plans** (recommended for new deployments).
110
-
-**Legacy Standard App Service plans** (existing users).
111
+
-**Premium App Service plans** (recommended for new deployments)
112
+
-**Legacy Standard App Service plans** (existing users)
111
113
112
114
> [!IMPORTANT]
113
-
> **Premium plans** are recommended for new deployments that require end-to-end encryption and other advanced security features.
115
+
> **Premium plans** are recommended for new deployments that require E2E encryption and other advanced security features.
114
116
115
-
### How to enable end-to-end TLS encryption
117
+
### Enable end-to-end TLS encryption
116
118
117
119
You can enable E2E TLS encryption via:
118
120
119
-
-**Azure portal** settings.
120
-
-**Azure CLI** commands.
121
-
-**ARM templates** for automation.
121
+
- Azure portal settings
122
+
- Azure CLI commands
123
+
- ARM templates for automation
122
124
123
-
Once enabled, all intra-cluster communication for your web app will be encrypted using TLS, ensuring **end-to-end data protection**.
125
+
After you enable E2E TLS encryption, all intra-cluster communications for your web app are encrypted by using TLS, ensuring end-to-end data protection.
124
126
125
-
## SSL/TLS certificates on App Service
127
+
## TLS/SSL certificates on App Service
126
128
127
-
To serve HTTPS traffic, App Service requires an SSL/TLS certificate bound to your custom domain.
129
+
To serve HTTPS traffic, App Service requires a TLS/SSL certificate that is bound to your custom domain.
128
130
129
131
### Types of certificates
130
132
131
-
-**App Service Certificates (ASC)**
132
-
Fully managed certificates issued and renewed automatically by Azure, stored securely in Azure Key Vault.
133
+
-**App Service certificates (ASC)**. Fully managed certificates issued and renewed automatically by Azure, stored securely in Azure Key Vault.
133
134
134
-
-**Bring your own certificate (BYOC)**
135
-
Upload and manage certificates (PFX format) issued by third-party Certificate Authorities (CAs).
135
+
-**Bring your own certificate (BYOC)**. Upload and manage certificates (in PFX format) issued by third-party Certificate Authorities (CAs).
136
136
137
-
### Binding certificates to custom domains
137
+
### Bind certificates to custom domains
138
138
139
-
After uploading or creating a certificate, you bind it to a custom domain on your web app using:
139
+
After you upload or create a certificate, you bind it to a custom domain on your web app by using:
140
140
141
-
-**SNI SSL bindings** for multitenant hosting.
142
-
-**IP SSL bindings** for dedicated IP addresses.
141
+
-**SNI (Server Name Indication) SSL bindings** for multitenant hosting
142
+
-**IP SSL bindings** for dedicated IP addresses
143
143
144
144
> [!NOTE]
145
-
> Azure-managed domains (such as `*.azurewebsites.net`) are automatically secured with default certificates, requiring no additional configuration.
145
+
> Azure-managed domains (such as `*.azurewebsites.net`) are automatically secured with default certificates, so no extra configuration is required.
146
146
147
147
## Mutual TLS (mTLS) authentication
148
148
149
-
Azure App Service supports **mutual TLS (mTLS)** on **both Linux and Windows App Service plans**, allowing apps to require client certificates for added security.
149
+
Azure App Service supports *mutual TLS (mTLS)* on both Linux and Windows App Service plans, so apps can require client certificates for added security.
150
150
151
151
### How mTLS works
152
152
153
-
- Clients present certificates that are validated against a trusted CA chain you configure.
154
-
- Only clients with valid certificates can connect.
155
-
-Commonly used to secure APIs and internal apps.
153
+
- Clients present certificates that are validated against a trusted CA chain that you configure.
154
+
- Only clients that have valid certificates can connect.
155
+
-It's commonly used to secure APIs and internal apps.
156
156
157
157
### Configuration options
158
158
159
-
- Enable mTLS through **Azure portal**, **CLI**, or **ARM templates**.
159
+
- Enable mTLS by using the Azure portal, the Azure CLI, or ARM templates.
160
160
- Upload trusted CA certificates for client validation.
161
161
- Access client certificate information in app code via request headers.
162
162
163
163
## Automatic certificate management
164
164
165
165
Azure App Service provides built-in features to manage certificates automatically:
166
166
167
-
-**App Service managed certificates (free)**
168
-
Automatically issued and renewed for custom domains. These certificates are limited to basic domain validation and don't support wildcard or exportable certificates.
169
-
170
-
-**App Service Certificates (paid)**
171
-
Fully managed certificates that support advanced scenarios, including wildcard domains and exportable certificates. These are stored and managed in Azure Key Vault.
167
+
-**App Service managed certificates (free)**. Automatically issued and renewed for custom domains. These certificates are limited to basic domain validation and don't support wildcard or exportable certificates.
172
168
173
-
## Summary
169
+
-**App Service certificates (paid)**. Fully managed certificates that support advanced scenarios, including wildcard domains and exportable certificates. These certificates are stored and managed in Azure Key Vault.
174
170
175
-
Azure App Service makes it easy to help secure your web apps with SSL/TLS. With support for modern TLS versions, flexible certificate options, and advanced features like mutual TLS, App Service helps you protect data in transit and meet compliance requirements.
171
+
Azure App Service makes it easy to help secure your web apps by using TLS and SSL. With support for modern TLS versions, flexible certificate options, and advanced features like mutual TLS, App Service helps you protect data in transit and meet compliance requirements.
176
172
177
173
## Related content
178
174
179
175
-[Bind SSL certificates to your custom domain](configure-ssl-bindings.md)
180
-
-[Purchase and manage App Service Certificates](configure-ssl-app-service-certificate.md)
176
+
-[Purchase and manage App Service certificates](configure-ssl-app-service-certificate.md)
0 commit comments