Enable TLS 1.3 for Outbound Traffic

Question

Hi Team,

I am currently using Azure API Management (APIM) to expose APIs that call backend services hosted on Azure Web Apps. Recently, I updated my Web App configuration to require a minimum TLS version of 1.3 to enhance security compliance.

After this change, API calls routed through Azure API Management began to fail with internal server errors. Upon investigation, it appears that Azure API Management does not support TLS 1.3 for outbound (backend) connections, and defaults to TLS 1.2.

Could you please enable the TLS 1.3 Settings?

Answer 1

@Dinesh Gaikwad ,

Thank you for reaching out regarding the issue you're facing with Azure API Management (APIM) and TLS 1.3 support for outbound connections.

As of now, Azure API Management does not natively support TLS 1.3 for outbound connections by default. However, we understand your need for this feature to comply with security requirements. While TLS 1.3 support in APIM is being gradually rolled out, it is currently available for inbound traffic and requires manual configuration for outbound connections in certain tiers.

Here's a suggested approach:

For V1 Tiers: You can enable TLS 1.3 for outbound connections by manually configuring the "Protocols + ciphers" section in your APIM instance settings. Specifically, you will need to enable the TLS 1.3 cipher suites under the "Ciphers" tab. This could activate TLS 1.3 for your backend communications.

Update

For V2 Tiers: For V2 tiers, this cannot be enabled through the portal. The product team can enable this option for you from the backend.

Next Steps:

We will reach out through private comments to capture some information required to enable this option.