All geek questions in one place

Is it possible to configure Azure SSL protocols and ciphers on a website

I want to disable TLS 1.0 protocol and RC4 cipher on an Azure website (or web application), and I cannot figure out if this is possible or not. ( change ). I know that SSL 3.0 is disabled by default on Azure sites, but I specifically want to disable TLS 1.0)

I know what registry settings I need to update, but the problem is that I do not have access to the OS.

NWebsec startup tasks are launched here that allow you to configure web roles (or cloud services), but I understand that this solution does not apply to web applications.

Is there a workaround?

+6
source share
1 answer

Update January 2017

Microsoft has completed a feature whereby TLS1.0 can be disabled by configuring the App Service environment. You can configure your own ciphers through Azure Resource Manager or change the cipher dialing order.

Details are available on the User Configuration Settings page for the App Service environment .

Original answer:

The initial answer was that it was not possible to configure anything in the registry or SSL settings in Azure web applications.

Microsoft is aware of PCI compliance changes and is updating host machines that web applications run on their own timelines. They announced in January 2015 that they would start making updates on July 18, 2015, leading to an A rating for TLS / SSL endpoints for Auzre web applications on sites like http://ssllabs.com

This is likely to be a continuing problem as computing power increases and more vulnerabilities are identified, and hosted web applications must rely on Microsoft to keep their servers up to date and up to date.

This link provides additional background information on the changes Microsoft makes: https://social.msdn.microsoft.com/Forums/azure/en-US/50f1ab33-c22a-4629-951e-b7510f6b2cbe/upgrading-tlsssl-cryptography-for -azure-web-apps? forum = windowsazurewebsitespreview

And this link also tracks a feature request that asks MS to disable insecure ciphers in web applications: http://feedback.azure.com/forums/169385-web-apps-formerly-websites/suggestions/7091994-disable-insecure-ciphers -in-azure-websites? page = 2 & per_page = 20

If access to the registry and specific control of these parameters is required, the Azure parameters are the Cloud Service or IAA web services.

Vote make MS disable TLS 1.0

+6
source

Source: https://habr.com/ru/post/985954/

More articles:


All Articles