Azure Storage Account endpoints advertises TLS 1.0/1.1 and 3DES cipher — is this a vulnerability?

Question

Azure Storage Account endpoints advertises TLS 1.0/1.1 and 3DES cipher — is this a vulnerability?

Gnrgy IT, Gnrgy 60

I ran an sslscan against my Azure Storage Account endpoints and noticed that it advertises support for legacy protocols (TLS 1.0, TLS 1.1) and weak ciphers like TLS_RSA_WITH_3DES_EDE_CBC_SHA

However, I’ve already enforced TLS 1.2 at the storage account level Screenshot 2025-05-15 130107

Shravan Addagatla 1,530 Reputation points Microsoft External Staff Moderator

2025-05-16T08:57:30.3533333+00:00

Hello Gnrgy IT, Gnrgy

Following up to see if you had a chance to review the response from Michele Ariis, who shared the details for your request.

Could you please check and let us know if you have any further questions?

Thank you.
Shravan Addagatla 1,530 Reputation points Microsoft External Staff Moderator

2025-05-19T08:43:45.2866667+00:00

Hello Gnrgy IT, Gnrgy

I didn't seem to hear from you since my last reply, so I checked to see how the situation was.

If still you have any questions, please let us know and we'll continue to support you here.

Accepted answer

0 additional answers

Your answer

Shravan Addagatla 1,530 Reputation points Microsoft External Staff Moderator

2025-05-16T08:57:30.3533333+00:00

Hello Gnrgy IT, Gnrgy

Following up to see if you had a chance to review the response from Michele Ariis, who shared the details for your request.

Could you please check and let us know if you have any further questions?

Thank you.
Shravan Addagatla 1,530 Reputation points Microsoft External Staff Moderator

2025-05-19T08:43:45.2866667+00:00

Hello Gnrgy IT, Gnrgy

I didn't seem to hear from you since my last reply, so I checked to see how the situation was.

If still you have any questions, please let us know and we'll continue to support you here.

Answer 1

Hey, seeing TLS 1.0/1.1 and 3-DES in a sslscan report on a storage account is not a vulnerability.

Even if the TLS handshake "succeeds", Azure blocks everything at the application layer if you have set the Minimum TLS Version to 1.2 (as you already have). Clients trying TLS 1.0/1.1 get an HTTP 400 right away on the first request.

Most scanners stop at the handshake and don't interpret the HTTP response, so they report "TLS 1.0 support" even though it's not actually usable.

If you want to prove it to an auditor:

curl --tls-max 1.0 https://<account>.blob.core.windows.net/ -v

--Response: HTTP 400 - TLS version not permitted

It's just an "optical trick" of the scanning tools. Your storage is compliant.

Share via

Azure Storage Account endpoints advertises TLS 1.0/1.1 and 3DES cipher — is this a vulnerability?

0 additional answers

Your answer