Skip to content

Commit b1bb111

Browse files
kgrembankgremban
committed
Update tls cipher list
1 parent c2838f2 commit b1bb111

File tree

1 file changed

+30
-34
lines changed

1 file changed

+30
-34
lines changed

‎articles/iot-hub/iot-hub-tls-support.md

Lines changed: 30 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
author: kgremban
66
ms.service: azure-iot-hub
77
ms.topic: conceptual
8-
ms.date: 1/7/2025
8+
ms.date: 02/24/2025
99
ms.author: kgremban
1010
---
1111

@@ -18,7 +18,7 @@ IoT Hub uses Transport Layer Security (TLS) to secure connections from IoT devic
1818
>
1919
> It's therefore essential that you properly test and validate that *all* your IoT devices and services are compatible with TLS 1.2 and the [recommended ciphers](#cipher-suites) in advance. It's highly recommended to use the [minimum TLS enforcement feature](#enforce-iot-hub-to-use-tls-12-and-strong-cipher-suites) as the mechanism for testing and compliance
2020
>
21-
> To find out the version of TLS your IoT Hub devices are running, please refer to [TLS 1.0 and 1.1 end of support guide](#checking-tls-versions-for-iot-hub-devices).
21+
> To find out the version of TLS your IoT Hub devices are running, refer to [TLS 1.0 and 1.1 end of support guide](#checking-tls-versions-for-iot-hub-devices).
2222
2323
## Mutual TLS support
2424

@@ -44,40 +44,36 @@ For links to download these certificates, see [Azure Certificate Authority detai
4444
Root CA migrations are rare. You should always prepare your IoT solution for the unlikely event that a root CA is compromised and an emergency root CA migration is necessary.
4545

4646
## Cipher Suites
47-
To comply with Azure security policy for a secure connection, IoT Hub supports the following RSA and ECDSA cipher suites for TLS 1.2:
48-
* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
49-
* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
50-
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
51-
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
52-
* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
53-
* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
54-
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
55-
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
56-
57-
The following cipher suites are currently allowed in IoT Hub. However, these cipher suites are no longer recommended by the Azure security guidelines.
58-
59-
| Cipher Suites | TLS Version support |
60-
|---------------------------------------|------------------------------------|
61-
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 | TLS 1.2 |
62-
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 | TLS 1.2 |
63-
| TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 | TLS 1.2 |
64-
| TLS_RSA_WITH_AES_256_GCM_SHA384 | TLS 1.2 |
65-
| TLS_RSA_WITH_AES_128_GCM_SHA256 | TLS 1.2 |
66-
| TLS_RSA_WITH_AES_256_CBC_SHA256 | TLS 1.2 |
67-
| TLS_RSA_WITH_AES_128_CBC_SHA256 | TLS 1.2 |
68-
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA | TLS 1.0/1.1/1.2|
69-
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | TLS 1.0/1.1/1.2|
70-
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA | TLS 1.0/1.1/1.2|
71-
| TLS_RSA_WITH_3DES_EDE_CBC_SHA | TLS 1.0/1.1/1.2|
72-
| TLS_RSA_WITH_3DES_EDE_CBC_SHA | TLS 1.0/1.1/1.2|
73-
| TLS_RSA_WITH_AES_128_CBC_SHA | TLS 1.0/1.1/1.2|
74-
| TLS_RSA_WITH_AES_256_CBC_SHA | TLS 1.0/1.1/1.2|
75-
76-
A client can suggest a list of higher cipher suites to use during `ClientHello`. However, some of them might not be supported by IoT Hub (for example, `ECDHE-ECDSA-AES256-GCM-SHA384`). In this case, IoT Hub tries to follow the preference of the client, but eventually negotiate down the cipher suite with `ServerHello`.
47+
48+
To comply with Azure security policy for a secure connection, IoT Hub recommends the following RSA and ECDSA cipher suites that require minimum TLS 1.2 enforcement:
49+
50+
* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
51+
* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
52+
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
53+
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
54+
* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
55+
* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
56+
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
57+
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
58+
59+
The following cipher suites are currently allowed in IoT Hub. However, these cipher suites are no longer recommended by the Azure security guidelines. These cipher suites work with TLS versions 1.0, 1.1, and 1.2.
60+
61+
* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
62+
* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
63+
* TLS_RSA_WITH_AES_256_GCM_SHA384
64+
* TLS_RSA_WITH_AES_128_GCM_SHA256
65+
* TLS_RSA_WITH_AES_256_CBC_SHA256
66+
* TLS_RSA_WITH_AES_128_CBC_SHA256
67+
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
68+
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
69+
* TLS_RSA_WITH_AES_128_CBC_SHA
70+
* TLS_RSA_WITH_AES_256_CBC_SHA
71+
72+
A client can suggest a list of higher cipher suites to use during `ClientHello`. However, IoT Hub might not support some of them, for example, `ECDHE-ECDSA-AES256-GCM-SHA384`. In this case, IoT Hub tries to follow the preference of the client but eventually negotiate down the cipher suite with `ServerHello`.
7773

7874
## Enforce IoT Hub to use TLS 1.2 and strong cipher suites
7975

80-
To ensure your IoT devices are TLS 1.2 and [strong cipher suites](#cipher-suites) compliance, you can enforce compliance using minimum TLS enforcement feature in Azure IoT Hub.
76+
To ensure your IoT devices are TLS 1.2 and [strong cipher suites](#cipher-suites) compliance, you can enforce compliance using minimum TLS enforcement feature in Azure IoT Hub.
8177

8278
Currently this feature is only available in the following regions and during IoT Hub creation (other Azure regions will be supported in 2025):
8379

@@ -94,7 +90,7 @@ To enable TLS 1.2 and strong cipher suites enforcement in Azure portal:
9490
3. Under **Management -> Advanced -> Transport Layer Security (TLS) -> Minimum TLS version**, select **1.2**. This setting only appears for IoT hub created in supported region.
9591

9692
:::image type="content" source="media/iot-hub-tls-12-enforcement.png" alt-text="Screenshot showing how to turn on TLS 1.2 enforcement during IoT hub creation.":::
97-
4. Click **Create**
93+
4. Select **Create**
9894
5. Connect your IoT devices to this IoT Hub
9995

10096
To use ARM template for creation, provision a new IoT Hub in any of the supported regions and set the `minTlsVersion` property to `1.2` in the resource specification:

0 commit comments

Comments
 (0)