Description:

This check verifies that Azure Database for MySQL Flexible Server is configured to enforce TLS 1.2 for all client connections. TLS 1.2 provides secure encryption for data transmitted between clients and the MySQL server and helps protect against known vulnerabilities present in older TLS versions.


Rationale:

Older TLS versions such as TLS 1.0 and TLS 1.1 contain known security weaknesses and are no longer considered secure by industry standards. Enforcing TLS 1.2 ensures that communications between applications and the MySQL server are encrypted using modern cryptographic protocols, reducing the risk of data interception, man-in-the-middle attacks, and compliance violations.


Impact:

  • Protects data in transit using modern encryption standards.

  • Reduces exposure to vulnerabilities associated with older TLS protocols.

  • Supports compliance requirements such as PCI-DSS, HIPAA, and industry security best practices.

  • Improves the overall security posture of database communications.

  • Legacy applications using TLS 1.0 or TLS 1.1 may require updates before connecting successfully.


Default Value:

For newer Azure Database for MySQL Flexible Server deployments, TLS enforcement is enabled and TLS 1.2 is typically the default minimum supported version. Existing deployments should be reviewed to confirm compliance.


Remediation:

Test Plan:

Using Azure Portal

  1. Sign in to the Azure Portal.

  2. Navigate to Azure Database for MySQL Flexible Server.

  3. Select the MySQL Flexible Server.

  4. Under Settings, select Server Parameters.

  5. Search for the parameter:

     tls_version

  6. Verify the parameter value is set to:

     TLS 1.2

Implementation steps:

Using Azure Portal

  1. Sign in to the Azure Portal.

  2. Navigate to Azure Database for MySQL Flexible Server.

  3. Select the affected MySQL Flexible Server.

  4. Under Settings, select Server Parameters.

  5. Search for:

     tls_version

  6. Change the value to:

     TLS 1.2

  7. Click Save.

  8. Allow the configuration change to apply.


Backout Plan:

  1. Navigate to Azure Database for MySQL Flexible Server.

  2. Select the affected server.

  3. Open Server Parameters.

  4. Locate the tls_version parameter.

  5. Restore the previous TLS version if a critical application compatibility issue occurs.

  6. Save the configuration.

  7. Validate database connectivity for affected applications.

  8. Identify and upgrade legacy clients before re-enforcing TLS 1.2.

Note: Reverting to TLS 1.0 or TLS 1.1 should only be considered a temporary exception due to the security risks associated with older TLS versions.


References: