Azure API Management throwing error in connecting to backend which requires minimum TLS1.3

Question

We have a scenario where we need to connect to a third party service which requires minimum TLS 1.3. We are using Azure API Management (Developer SKU at the moment on v1 tier in West Europe Azure Region) to connect to that third party service.

As per this article: https://techcommunity.microsoft.com/blog/integrationsonazureblog/announcing-the-availability-of-tls-1-3-in-azure-api-management-in-preview/4047586 Azure API Management on v1 tiers should be able to support TLS1.3 for outbound traffic from API Gateway to API backend, however it puts a caveat that it needs to be enabled manually. I am not able to find any documentation on how to enable TLS1.3 for communication with backend in Azure API Management.

I have tried to set up a PoC for this i.e., Azure API Management (on Developer SKU on v1 tier in West Europe) on top of Http Triggered Azure Function which requires Minimum TLS 1.3. However, it throws an HTTP 500 Internal Server Error. The underlying trace shows:

forward-request (30.829 ms) { "messages": [ "Error occured while calling backend service.", "The request was aborted: Could not create SSL/TLS secure channel." ] }

To isolate the issue i.e., it is specifically due to Minimum TLS version configured as 1.3 on HTTP Triggered Azure Function, I tried configuring the HTTP Triggered Azure Function to use Minimum TLS version 1.2, and then Azure API Management is able to communicate with that http triggered Azure function without any issue. So, the issue is specifically when Azure API Management needs to communicate with a backend that requires Minimum TLS version 1.3

Any reference / how to article on any specific configuration(s) required in Azure API Management to be able to communicate with backends requiring minimum TLS version 1.3 is highly appreciated.

Answer 1

@ZQadir Thanks for reaching out. APIM outbound TLS 1.3 is off by default. Only inbound has TLS 1.3 enabled. Outbound can only be enabled by Product group team by raising support ticket but we don't recommend it for production scenarios as it is in preview currently. Plan is to make it available for customers around March-April 2025

do let me know incase of further queries, I would be happy to assist you.

Please accept as Yes if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.