Minimum TLS version

Security · Azure Database for MariaDB · 2022_12

Azure Database for MariaDB servers should reject TLS versions older than 1.2.

Description

The minimum version of TLS that Azure Database for MariaDB servers accept is configurable. Older TLS versions are no longer considered secure by industry standards, such as PCI DSS.

Azure lets you disable outdated protocols and require connections to use a minimum of TLS 1.2. By default, TLS 1.0, TLS 1.1, and TLS 1.2 is accepted.

Recommendation

Configure the minimum supported TLS version to be 1.2.

Examples

Configure with Azure template

To deploy Azure Database for MariaDB Servers that pass this rule:

• Set the properties.minimalTlsVersion property to TLS1_2.

For example:

Azure Template snippet

{
  "type": "Microsoft.DBforMariaDB/servers",
  "apiVersion": "2018-06-01",
  "name": "[parameters('serverName')]",
  "location": "[parameters('location')]",
  "sku": {
    "name": "[parameters('skuName')]",
    "tier": "GeneralPurpose",
    "capacity": "[parameters('SkuCapacity')]",
    "size": "[format('{0}', parameters('skuSizeMB'))]",
    "family": "[parameters('skuFamily')]"
  },
  "properties": {
    "minimalTlsVersion": "TLS1_2",
    "createMode": "Default",
    "version": "[parameters('mariadbVersion')]",
    "administratorLogin": "[parameters('administratorLogin')]",
    "administratorLoginPassword": "[parameters('administratorLoginPassword')]",
    "storageProfile": {
      "storageMB": "[parameters('skuSizeMB')]",
      "backupRetentionDays": 7,
      "geoRedundantBackup": "Enabled"
    }
  }
}

Configure with Bicep

To deploy Azure Database for MariaDB Servers that pass this rule:

• Set the properties.minimalTlsVersion property to TLS1_2.

For example:

Azure Bicep snippet

resource mariaDbServer 'Microsoft.DBforMariaDB/servers@2018-06-01' = {
  name: serverName
  location: location
  sku: {
    name: skuName
    tier: 'GeneralPurpose'
    capacity: skuCapacity
    size: '${skuSizeMB}' 
    family: skuFamily
  }
  properties: {
    minimalTlsVersion: 'TLS1_2'
    createMode: 'Default'
    version: mariadbVersion
    administratorLogin: administratorLogin
    administratorLoginPassword: administratorLoginPassword
    storageProfile: {
      storageMB: skuSizeMB
      backupRetentionDays: 7
      geoRedundantBackup: 'Enabled'
    }
  }
}

Links

• Data encryption in Azure
• TLS enforcement in Azure Database for MariaDB
• Set TLS configurations for Azure Database for MariaDB
• Preparing for TLS 1.2 in Microsoft Azure
• Azure deployment reference

---

Last update: 2022-11-20

Comments