Front Door Minimum TLS#
Security · Front Door · 2020_06
Front Door should reject TLS versions older than 1.2.
Description#
The minimum version of TLS that Azure Front Door accepts is configurable. Older TLS versions are no longer considered secure by industry standards, such as PCI DSS.
Front Door lets you disable outdated protocols and enforce TLS 1.2. By default, a minimum of TLS 1.2 is enforced.
Recommendation#
Consider configuring the minimum supported TLS version to be 1.2.
Examples#
Configure with Azure template#
To deploy a Front Door resource that passes this rule:
- Set the minTlsVersion to be '1.2'
For example:
Azure Template snippet
"resources": [
{
"type": "Microsoft.Cdn/profiles",
"apiVersion": "2021-06-01",
"name": "[parameters('frontDoorName')]",
"location": "Global",
"sku": {
"name": "Standard_AzureFrontDoor"
}
},
{
"type": "Microsoft.Web/serverfarms",
"apiVersion": "2020-06-01",
"name": "[variables('frontDoorAppServicePlanName')]",
"location": "[parameters('location')]",
"sku": {
"name": "S1",
"capacity": 1
},
"kind": "app"
},
{
"type": "Microsoft.Web/sites",
"apiVersion": "2020-06-01",
"name": "[variables('frontDoorAppName')]",
"location": "[parameters('location')]",
"kind": "app",
"identity": {
"type": "SystemAssigned"
},
"properties": {
"serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('frontDoorAppServicePlanName'))]",
"httpsOnly": true,
"siteConfig": {
"detailedErrorLoggingEnabled": true,
"httpLoggingEnabled": true,
"requestTracingEnabled": true,
"ftpsState": "Disabled",
"minTlsVersion": "1.2",
"ipSecurityRestrictions": [
{
"tag": "ServiceTag",
"ipAddress": "AzureFrontDoor.Backend",
"action": "Allow",
"priority": 100,
"headers": {
"x-azure-fdid": [
"[reference(resourceId('Microsoft.Cdn/profiles', parameters('frontDoorName'))).frontDoorId]"
]
},
"name": "Allow traffic from Front Door"
}
]
}
},
"dependsOn": [
"[resourceId('Microsoft.Web/serverfarms', variables('frontDoorAppServicePlanName'))]",
"[resourceId('Microsoft.Cdn/profiles', parameters('frontDoorName'))]"
]
}
]
Configure with Bicep#
To deploy a Front Door resource that passes this rule:
- Set the minTlsVersion to be '1.2'
For example:
Azure Bicep snippet
resource frontDoorResource 'Microsoft.Cdn/profiles@2021-06-01' = {
name: frontDoorName
location: 'Global'
sku: {
name: 'Standard_AzureFrontDoor'
}
}
resource appServicePlanResource 'Microsoft.Web/serverFarms@2020-06-01' = {
name: frontDoorAppServicePlanName
location: location
sku: {
name: 'S1'
capacity: 1
}
kind: 'app'
}
resource appResource 'Microsoft.Web/sites@2020-06-01' = {
name: frontDoorAppName
location: location
kind: 'app'
identity: {
type: 'SystemAssigned'
}
properties: {
serverFarmId: appServicePlanResource.id
httpsOnly: true
siteConfig: {
detailedErrorLoggingEnabled: true
httpLoggingEnabled: true
requestTracingEnabled: true
ftpsState: 'Disabled'
minTlsVersion: '1.2'
ipSecurityRestrictions: [
{
tag: 'ServiceTag'
ipAddress: 'AzureFrontDoor.Backend'
action: 'Allow'
priority: 100
headers: {
'x-azure-fdid': [
frontDoorResource.properties.frontDoorId
]
}
name: 'Allow traffic from Front Door'
}
]
}
}
}
Links#
- Data encryption in Azure
- Preparing for TLS 1.2 in Microsoft Azure
- What TLS versions are supported by Azure Front Door Service?
- Azure deployment reference
Last update:
2022-10-17