Detections
Analytics

7.12 Ensure the SSL Policy's 'Min protocol version' is Set to 'TLSv1_2' or Higher on Azure Application Gateway

Information

The TLS (Transport Layer Security) protocol secures data in transit using asymmetric encryption. Application gateways use TLS 1.2 for the Min protocol version by default but can also be configured to use TLS 1.3.

According to Microsoft, "Starting August 31, 2025, all clients and backend servers interacting with Azure Application Gateway must use Transport Layer Security (TLS) 1.2 or higher, as support for TLS 1.0 and 1.1 will be discontinued."

In NIST SP 800-52 Rev. 2, NIST has mandated that servers that support both government-only applications as well as citizen or business-facing applications " shall be configured to use [or negotiate] TLS 1.2 and should be configured to use [or negotiate] TLS 1.3 as well." Further, NIST specifies that "agencies shall support TLS 1.3 by January 1, 2024 [for both government-only and citizen or business-facing applications]." In general, NIST indicates that "servers that support TLS 1.3 should be configured to use TLS 1.2 as well. However, TLS 1.2 may be disabled on servers that support TLS 1.3 [if TLS 1.2 is not needed for interoperability]."

POST-QUANTUM CRYPTOGRAPHY: TLS v1.3 introduces cryptographic suites which make Post-Quantum Cryptography (PQC) algorithms accessible. Where possible, TLS v1.3 should be implemented as the sole protocol in use for the security of data in transit, but only if TLS 1.2 interoperability is not required.

These protocols are outdated, vulnerable, and shall not be used: TLS 1.0, TLS 1.1, SSL 2.0, SSL 3.0.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Remediate from Azure Portal

 - Go to Application gateways.
 - Click the name of an application gateway.
 - Under Settings, click Listeners.
 - Under SSL Policy, next to the Selected SSL Policy name, click change.
 - Select an appropriate SSL policy with a Min protocol version of TLSv1_2 or higher.
 - Click Save.
 - Repeat steps 1-6 for each application gateway requiring remediation.

Remediate from Azure CLI

Run the following command to list available SSL policy options:

az network application-gateway ssl-policy list-options

Run the following command to list available predefined SSL policies:

az network application-gateway ssl-policy predefined list

For each application gateway requiring remediation, run the following command to set a predefined SSL policy:

az network application-gateway ssl-policy set --resource-group <resource-group> --gateway-name <application-gateway> --name <ssl-policy> --policy-type Predefined

Alternatively, run the following command to set a custom SSL policy:

az network application-gateway ssl-policy set --resource-group <resource-group> --gateway-name <application-gateway> --policy-type Custom --min-protocol-version <min-protocol-version> --cipher-suites <cipher-suites>

Impact:

Using the latest TLS version may affect compatibility with clients and backend services.

See Also

https://workbench.cisecurity.org/benchmarks/24282

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: microsoft_azure

Control ID: f48cc71dc2378cc590fc5f6368ac9cc1c162834396c1a196abeeefb6b6f162f7