Description
The TLS (Transport Layer Security) protocol secures transmission of data over the internet using standard encryption technology. Encryption should be set with the latest version of TLS. App service allows TLS 1.2 by default, which is the recommended TLS level by industry standards such as PCI DSS.
Rationaleβ
App service currently allows the web app to set TLS versions 1.0, 1.1 and 1.2. It is highly recommended to use the latest TLS 1.2 version for web app secure connections.
Auditβ
From Azure Portalβ
- Login to Azure Portal using https://portal.azure.com.
- Go to
App Services
. - Click on each App.
- Under
Setting
section, Click onTLS/SSL settings
. - Under the
Bindings
pane, ensure thatMinimum TLS Version
set to1.2
underProtocol Settings
.
From Azure CLIβ
To check TLS Version for an existing app, run the following command:
az webapp config show --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME> --query minTlsVersion
The output should return 1.2
if TLS Version is set to 1.2
(Which is currently the latest version).
From PowerShellβ
List all web apps:
Get-AzWebApp
For each web app run the following command:
Get-AzWebApp -ResourceGroupName <RESOURCE_GROUP_NAME> -Name <APP_NAME> |Select-Object -ExpandProperty SiteConfig
Make sure the minTlsVersion
is set to at least 1.2
.
From Azure Policyβ
If referencing a digital copy of this Benchmark, clicking a Policy ID will open a link to the associated Policy definition in Azure.
- Policy ID: f9d614c5-c173-4d56-95a7-b4437057d193 - Name:
Function apps should use the latest TLS version
- Policy ID: f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b - Name:
App Service apps should use the latest TLS version
Default Valueβ
By default, TLS Version feature will be set to 1.2 when a new app is created using the command-line tool or Azure Portal console.
Referencesβ
- https://docs.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-ssl#enforce-tls-versions
- https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-data-protection#dp-3-encrypt-sensitive-data-in-transit
- https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-network-security#ns-8-detect-and-disable-insecure-services-and-protocols
- https://docs.microsoft.com/en-us/powershell/module/az.websites/set-azwebapp?view=azps-8.1.0