Minimum TLS version

Security · Event Hub · 2023_03

Event Hub namespaces should reject TLS versions older than 1.2.

Description

The minimum version of TLS that Event Hub namespaces accept is configurable. Older TLS versions are no longer considered secure by industry standards, such as PCI DSS.

Azure lets you disable outdated protocols and require connections to use a minimum of TLS 1.2. By default, TLS 1.0, TLS 1.1, and TLS 1.2 is accepted.

Recommendation

Configure the minimum supported TLS version to be 1.2.

Examples

Configure with Azure template

To deploy Event Hub namespaces that pass this rule:

• Set the properties.minimumlTlsVersion property to 1.2.

For example:

Azure Template snippet

{
  "type": "Microsoft.EventHub/namespaces",
  "apiVersion": "2022-01-01-preview",
  "name": "[parameters('eventHubNamespaceName')]",
  "location": "[parameters('location')]",
  "sku": {
    "name": "[parameters('eventHubSku')]",
    "tier": "[parameters('eventHubSku')]",
    "capacity": 1,
  },
  "properties": {
    "minimumTlsVersion": "1.2",
  }
}

Configure with Bicep

To deploy Event Hub namespaces that pass this rule:

• Set the properties.minimumlTlsVersion property to 1.2.

For example:

Azure Bicep snippet

resource eventHubNamespace 'Microsoft.EventHub/namespaces@2022-01-01-preview' = {
  name: eventHubNamespaceName
  location: location
  sku: {
    name: eventHubSku
    tier: eventHubSku
    capacity: 1
  }
  properties: {
    minimumTlsVersion: '1.2'
  }
}

Links

• Data encryption in Azure
• Enforce a minimum required version of Transport Layer Security (TLS) for requests to an Event Hubs namespace
• Preparing for TLS 1.2 in Microsoft Azure
• Azure deployment reference

---

Last update: 2023-03-09

Comments