Minimum TLS version#
Security · Event Hub · 2023_03
Event Hub namespaces should reject TLS versions older than 1.2.
Description#
The minimum version of TLS that Event Hub namespaces accept is configurable. Older TLS versions are no longer considered secure by industry standards, such as PCI DSS.
Azure lets you disable outdated protocols and require connections to use a minimum of TLS 1.2. By default, TLS 1.0, TLS 1.1, and TLS 1.2 is accepted.
Recommendation#
Configure the minimum supported TLS version to be 1.2.
Examples#
Configure with Azure template#
To deploy Event Hub namespaces that pass this rule:
- Set the
properties.minimumlTlsVersion
property to1.2
.
For example:
Azure Template snippet
{
"type": "Microsoft.EventHub/namespaces",
"apiVersion": "2022-01-01-preview",
"name": "[parameters('eventHubNamespaceName')]",
"location": "[parameters('location')]",
"sku": {
"name": "[parameters('eventHubSku')]",
"tier": "[parameters('eventHubSku')]",
"capacity": 1,
},
"properties": {
"minimumTlsVersion": "1.2",
}
}
Configure with Bicep#
To deploy Event Hub namespaces that pass this rule:
- Set the
properties.minimumlTlsVersion
property to1.2
.
For example:
Azure Bicep snippet
resource eventHubNamespace 'Microsoft.EventHub/namespaces@2022-01-01-preview' = {
name: eventHubNamespaceName
location: location
sku: {
name: eventHubSku
tier: eventHubSku
capacity: 1
}
properties: {
minimumTlsVersion: '1.2'
}
}
Links#
- Data encryption in Azure
- Enforce a minimum required version of Transport Layer Security (TLS) for requests to an Event Hubs namespace
- Preparing for TLS 1.2 in Microsoft Azure
- Azure deployment reference
Last update:
2023-03-09