Does Azure App Service Support TLS 1.3

Question

Does Azure App Service Support TLS 1.3 for both inbound and outbound calls? If yes, how can that configuration be made?

Needs to understand this for both Windows and Linux App services for all the Plans.

Answer 1

Hello @Harsh Thakor

The answer to your question is yes both support TLS 1.3.

Here's how you can configure TLS 1.3 for both Windows and Linux App Services in Azure:

Windows App Service:

• To enable TLS 1.3 for your Windows App Service, you typically don't need to make any specific configuration changes on the App Service level. Azure manages the TLS settings for you. However, you can control the TLS version supported by your application code if needed.
• You can configure your application code to use TLS 1.3 by modifying the application's code or application framework settings (e.g., .NET Core or ASP.NET). Most modern frameworks and libraries should automatically use the highest TLS version available, which includes TLS 1.3 if the client and server support it.

1. Linux App Service:

For Linux-based App Services, you can configure the TLS settings at the server level, which includes support for TLS 1.3.

• To enable TLS 1.3 for your Linux App Service, you can make use of a custom Nginx configuration file. Here's how:
  • Access your Linux App Service through SSH.
  • Navigate to the /home/site/wwwroot directory.
  • Create an .nginx.conf file with your custom Nginx configuration.
  • In the configuration file, you can specify TLS settings, including enabling TLS 1.3. Here's an example of the TLS settings in the Nginx configuration:

      nginxCopy code
      ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
      
      ```

               - Save the configuration file.

                        - Finally, restart the Nginx service to apply the changes:

                        
```yaml
                        bashCopy code
                        systemctl restart nginx
                        
                        
                        ```

Answer 2

Hi @Harsh Thakor adding to Terae answer-

ETA for TLS 1.3 support is Q1 of next year.

• For Windows App Service, TLS 1.3 is not yet supported. The underlying Windows Server 2016 OS does not include TLS 1.3 support.
• For Linux App Service, TLS 1.3 is supported on the latest stack versions - Debian 10 and Ubuntu 18.04 or higher. Lower versions do not include TLS 1.3 support.
• To check the Linux stack version, go to the App Service and under Settings > Configuration > General Settings view the current Linux OS type.
• You can enforce a minimum TLS version of 1.2 for all App Services under SSL settings, but not 1.3 yet.
• To identify the negotiated TLS version and cipher suite in use, enable diagnostics logging and look for the TLS handshake details in the logs. You can also use Fiddler or openssl to test connections.
• For calling external APIs, App Services will negotiate the highest common TLS version supported by both endpoints.

Hope that helps.

-Grace

Answer 3

Hi @Grmacjon-MSFT ,

For Windows App Service, TLS 1.3 is not yet supported. The underlying Windows Server 2016 OS does not include TLS 1.3 support.

Do you have any ETA for this? We are in situations where we consumme API allowing TLS1.3 only. This is currently not working (because as you said the Windows OS does not supports it).

Regards,