Description:
The TLS (Transport Layer Security) protocol secures transmission of data over the internet using standard encryption technology. Encryption should be set with the latest version of TLS. App service allows TLS 1.2 by default, which is the recommended TLS
level by industry standards such as PCI DSS.
Rationale:
App service currently allows the web app to set TLS versions 1.0, 1.1 and 1.2. It is highly recommended to use the latest TLS 1.2 version for web app secure connections.
Audit:
From Azure Portal
1. Login to Azure Portal using https://portal.azure.com
2. Go to App Services
3. Click on each App
4. Under Setting section, Click on TLS/SSL settings
5. Under the Bindings pane, ensure that Minimum TLS Version set to 1.2 under Protocol Settings
From Azure CLI
To check TLS Version for an existing app, run the following command,
az webapp config show --resource-group <RESOURCE_GROUP_NAME> --name
<APP_NAME> --query minTlsVersion
The output should return 1.2 if TLS Version is set to 1.2 (Which is currently the latest version).
From PowerShell
List all web apps.
Get-AzWebApp
For each web app run the following command.
Get-AzWebApp -ResourceGroupName <RESOURCE_GROUP_NAME> -Name <APP_NAME>
|Select-Object -ExpandProperty SiteConfig
Make sure the minTlsVersion is set to at least 1.2.
Remediation:
From Azure Portal
1. Login to Azure Portal using https://portal.azure.com
2. Go to App Services
3. Click on each App
4. Under Setting section, Click on SSL settings
5. Under the Bindings pane, set Minimum TLS Version to 1.2 under Protocol Settings section
From Azure CLI
To set TLS Version for an existing app, run the following command:
az webapp config set --resource-group <RESOURCE_GROUP_NAME> --name <APP_NAME>
--min-tls-version 1.2
From PowerShell
Set-AzWebApp -ResourceGroupName <RESOURCE_GROUP_NAME> -Name <APP_NAME> -
MinTlsVersion 1.2
Default Value:
By default, TLS Version feature will be set to 1.2 when a new app is created using the command-line tool or Azure Portal console.
References:
4. https://docs.microsoft.com/en-us/powershell/module/az.websites/setazwebapp?view=azps-8.1.0