How do you disable TLS/SSL support for 3DES cipher suite on a Private end point...when the private end point NIC is on an Azure storage account?

Question

I have a private end point (xxxxxxxxx-pe)...NIC on Azure storage account yyyyyyyyyyy. And I need to Disable TLS/SSL support for 3DES cipher suite...on this server or Private end point. How do you disable TLS/SSL support for 3DES cipher suite on a Private end point...when the private end point NIC is on an Azure storage account?

Answer 1

@Paul Swaray Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

You can disable TLS 1.0 and 1.1 on the storage account. That will apply to connections over the private endpoint as well.

This article explains the supported registry setting information for the Windows implementation of the Transport Layer Security (TLS) protocol

How to disable protocols

Please let us know if you have any further queries. I’m happy to assist you further.

----------

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

@Paul Swaray Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

You can disable TLS 1.0 and 1.1 on the storage account. That will apply to connections over the private endpoint as well.

This article explains the supported registry setting information for the Windows implementation of the Transport Layer Security (TLS) protocol

How to disable protocols

Please let us know if you have any further queries. I’m happy to assist you further.

----------

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 3

As listed on https://learn.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version?tabs=portal

"The cipher suite used when clients send data to and receive data from a storage account is dependent on the TLS version used. It is not possible to configure a storage account to block the use of specific ciphers, other than by requiring a minimum TLS version. If you require the ability to allow only specific cipher suites when connecting to your storage account, consider using Azure Application Gateway. For more information about using Application Gateway for this purpose, see Configure TLS policy versions and cipher suites on Azure Application Gateway."