TLS 1.2 Connection details between source and target database

Question

Hi,

In my case - I am migrating the data from oracle on premises to the azure sql database.

Below are the connections used.

Connection-1

Oracle (on-prem)-->ADFSHIR-->F5-->Express Route Gateway-->Azurefirewall-->Private End Point-->Azure Sql server database.

Connection-2

Oracle (on-prem)-->ADFSHIR-->F5-->Express Route Gateway-->Azurefirewall-->Private End Point-->data Factory instance.

Question-1 As during connection-1 the data migration from oracle to azure sql database , data in transit is secured by TLS 1.2 as per Microsoft documentation.

The TLS 1.2 certificate , certificate storage, certificate renewal,CRL, certificate revocation, private keys are all managed by Microsoft ?

Or we need to store the certificate in the SHIR ?

Question-2

During connection-2 below.

Oracle (on-prem)-->ADFSHIR-->F5-->Express Route Gateway-->Azurefirewall-->Private End Point-->data Factory instance.

In our scenario there is TLS 1.2 connection between ADFSHIR till ADF Instance.

For above TLS 1.2 case do i need to manage the TLS 1.2 certificate , certificate storage, certificate renewal,CRL, certificate revocation, private keys or its is managed by Microsoft .?

Answer 1

Hello @Kashish

By default, the traffic between ADF and SHIR is through TLS1.2, the onprem to cloud data movement happen through TLS1.2 encryption, but the traffic between SHIR and your service encryption depends on your service protocol (HTTPS, SFTP etc). The Product guarantee the communication between SHIR and ADF service is using TLS 1.2.

You got the Private endpoints for both scenarios!

In this scenario, the TLS 1.2 certificate is typically managed by the components that terminate the TLS connection. This usually includes the Azure Firewall, the Private Endpoint.

All data transfers are via secure channel HTTPS and TLS over TCP to prevent man-in-the-middle attacks during communication with Azure services.

For more details, refer to Security considerations for data movement in Azure Data Factory.

For other components such as on-premises infrastructure lies with the customer or the organization managing the network infrastructure.