🛡️ Azure Application Gateway minimum TLS version is below 1.3🟢

• Contextual name: 🛡️ Application Gateway minimum TLS version is below 1.3🟢
• ID: /ce/ca/azure/application-gateway/gateway-tls-1-3
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure Application Gateway
  • 🔌 Azure Application Gateway - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Azure Application Gateway sets the minimum TLS version for client connections through its SSL policy, at the gateway and in each SSL profile. The Min protocol version selects TLSv1_2 or TLSv1_3 on a supported policy, and only a CustomV2 policy can select TLSv1_3. Prerequisites: Confirm from the gateway's Client TLS protocol metric that no client that must keep access still connects with TLS 1.2.

Rationale

With TLS 1.2 enabled, the gateway's policy can permit cipher suites without forward secrecy, and TLS 1.2 handshakes send the server certificate unencrypted. If the certificate's private key is later exposed, traffic recorded under those suites can be decrypted. NIST SP 800-52 Revision 2 permits disabling TLS 1.2 on servers that support TLS 1.3 when interoperability does not require it.

Audit

This policy marks an Azure Application Gateway as INCOMPLIANT if the collected gateway-level minimum SSL protocol is TLSv1_0, TLSv1_1, or TLSv1_2.

TLSv1_3 is COMPLIANT within the collected gateway-level scope.

Remediation

Open File

Remediation

Review client TLS 1.3 compatibility and the gateway SKU before changing protocol requirements. TLS 1.3 requires a supported v2 gateway and compatible SSL policy.

In Application gateways > Listeners / SSL Policy, configure the gateway minimum protocol as TLSv1_3. Review SSL settings and every SSL profile with a listener-specific policy; set each minimum to TLSv1_3 or let it inherit the compliant gateway policy. Preserve required cipher configuration when modifying a custom policy.

Verify the gateway policy and all profile policies using az network application-gateway show, and test each HTTPS listener with required clients. Retain the previous policy configuration for rollback if critical clients fail.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS Azure v7.0.0 → 💼 7.2.3 Ensure the SSL Policy's 'Min protocol version' is Set to 'TLSv1_3' on Azure Application Gateway (Automated)			1		no data
💼 Cloudaware Framework → 💼 Cryptographic Configuration			20		no data