IOT Hub - how to change TLS 1.0 to TLS 1.2

Question

Hi Team,

How to change the TLS version 1.0 to 1.2 for Azure IoT Hub which is already created. Bcz we can see during creation of Iot Hub, there is option to set TLS 1.2. how to we changes after creation of IotHub.

Also we dont see TLS Certificate tab in Azure Portal --> IOT hub --> settings --> Certificates why?

Do we need to change the digicert CA certificate in all iot-edge devices? if yes what are the steps for ubuntu device.

Also any code changes required for TLS 1.2

Answer 1

The minimum TLS version can't be changed after creation of the hub. It's a readonly property. If you aim to upgrade the minimum TLS version, you can create a new IoT Hub and migrate your configuration and devices to it. This migration can be automated through the Azure CLI. This is an experimental feature, but works quite well. You can read more about it in the docs.

There will be impact to devices, as their connection string needs to point to the new IoT Hub. If you have DPS in place, this impact will be limited.

Answer 2

Hi @Madanala, Jayashree Thank you for posting the question here.

How to change the TLS version 1.0 to 1.2 for Azure IoT Hub which is already created

Unfortunately, this property is read-only at the moment and cannot be changed after the IoT Hub creation. Please refer to the following note from the documentation - TLS 1.2 enforcement available in select regions

Also we dont see TLS Certificate tab in Azure Portal --> IOT hub --> settings --> Certificates why?

If you referring to the root certificates that are recognized by the IoT Hub, you would find them under the certificates tab under your Device Provisioning Service. Please refer the below image for reference.

Do we need to change the digicert CA certificate in all iot-edge devices? if yes what are the steps for ubuntu device.

The documentation - Migrate IoT Hub resources to a new TLS certificate root is a good place that answers your questions. You typically do not need to make changes on the IoT Edge devices. However, you can use the steps mentioned in the How to Check and Validation from the post link for more details on this.

Also any code changes required for TLS 1.2

There are no explicit code changes required to make this transition work.

Hope this answers your questions. Please let us know if you need any further assistance or clarifications.