How to disable weaker TLS cipher suites for static web apps

Question

Oscar 0

try this

but I get this error because its a staticSites instead of sites and when I change it to staticSites

an error without message is displayed. Is there any other way to disable these weaker ciphers?

1 answer

Answer 1

VenkateshDodda-MSFT 24,946 Microsoft Employee Moderator

@Oscar Thanks for reaching out to Microsoft Q&A, apologize for any inconvenience caused on this.

The article that you are referring is applicable to disable the weak cipher suites in App service only.

Static Webapp uses shared infrastructure, these setting will be managed platform and you won't be able to change these cipher suites.

Feel free to reach back to me if you still have any further questions on this.

Sakaldeep Yadav 171 Reputation points MVP

2024-02-11T19:04:32.4866667+00:00

@VenkateshDodda-MSFT Pen-test report against StaticApp shows the weaker cipher suites and recommends setting it to the latest. If the cipher suites won't be changed then how to cover that vulnerability? Thanks
Kynsai Iangrai 40 Reputation points

2024-02-12T18:06:23.5466667+00:00

i am having same issues. We need to clear Pen test, please suggest a way to resolve this ASAP
Kynsai Iangrai 40 Reputation points

2024-02-12T18:09:02.3033333+00:00

kindly suggest a way out of this, Static web app technical team would be able to update these ciphers, isn't it?
Raymond de Jong 81 Reputation points

2024-10-08T09:12:11.87+00:00

Same issue here
Henri Pihkala 25 Reputation points

2025-04-01T14:30:51.9033333+00:00

Pentest flagged the weak ciphers for us as well. I can't believe the old ciphers are still supported, and there's no way for users to get rid of them.