Azure front door shows weak ciphers

Question

Azure front door shows weak ciphers

$@chin 200

Hi ,

During the VAPT, it was observed that backend resources such as Virtual Machines, API Management, Web Apps and Function Apps are configured to use strong cipher suites. Additionally, no CBC-based cipher suites are explicitly configured.

However, tools like SSL Labs and other VAPT tools still report the presence of weak ciphers, despite Azure Front Door being configured with the TLS v1.2_2023 policy which does not include CBC based ciphers.

Ques:

Is Azure Front Door still using weak cipher suites despite the configured policy ?
If yes, what are the recommended steps to fully eliminate or mitigate these ciphers ?
Is this a limitation or expected behavior in Azure Front Door’s design ?
If it is expected, should this be considered a security concern for our application ?

traffic flow is: Client (User) → Azure Front Door → Backend (VM / APIM / Function App)

$@chin 200 Reputation points

2025-06-18T16:14:04.03+00:00

Hi @praveen Bandaru ,

Azure Front Door Premium with the latest version and have configured it to use the most recent TLS policy. However, when checking the SSL/TLS configuration using SSL Labs, it still reports the presence of weak CBC-based cipher suites.

the backend services are already configured with strong cipher suites. In this case, the SSL Labs tool itself is acting as the client.

Attaching the screenshot for your reference.

Could you please advise why weak ciphers are still being detected and if any additional configuration is required on AFD ?
Praveen Bandaru 5,520 Reputation points Microsoft External Staff Moderator

2025-06-19T11:32:57.3133333+00:00

Hello $@chin

Thank you for your response. This script repeatedly initiates SSLv3/TLS connections, testing a new cipher or compressor each time, and records whether the host accepts or rejects it. The final result is a list of all the ciphersuites and compressors accepted by the server.

In the meantime, both week Ciphers are not supported in the TLSv1.2 2023 kindly check in the document.

Predefined TLS policy, Configure TLS policy on a Front Door custom domain

Please try removing both week ciphers using the custom option and test it. In the meantime, are you checking the default URL of the front door. Once your domain setup is complete, you can check and let me know.

Check the screen shot hot manage with custom option:

Test with Nmap and see the CBC ciphers information. Check the below command:

nmap -sV --script ssl-enum-ciphers -p 443 <host>

Using Nmap for Testing:

Nmap can be used to scan an Azure Front Door endpoint and identify the supported cipher suites.

The ssl-enum-ciphers script within Nmap can be used for this purpose.

The output will show the cipher suites, their strength (graded A through F, with E being weak), and other details.

You can identify CBC-based ciphers in the output.

In the meantime, please check the previous reference thread: https://learn.microsoft.com/en-us/answers/questions/2225749/is-there-a-way-to-disable-weak-cipher-suites-in-az

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Accepted answer

0 additional answers

Your answer

$@chin 200 Reputation points

2025-06-18T16:14:04.03+00:00

Hi @praveen Bandaru ,

Azure Front Door Premium with the latest version and have configured it to use the most recent TLS policy. However, when checking the SSL/TLS configuration using SSL Labs, it still reports the presence of weak CBC-based cipher suites.

the backend services are already configured with strong cipher suites. In this case, the SSL Labs tool itself is acting as the client.

Attaching the screenshot for your reference.

Could you please advise why weak ciphers are still being detected and if any additional configuration is required on AFD ?
Praveen Bandaru 5,520 Reputation points Microsoft External Staff Moderator

2025-06-19T11:32:57.3133333+00:00

Hello $@chin

Thank you for your response. This script repeatedly initiates SSLv3/TLS connections, testing a new cipher or compressor each time, and records whether the host accepts or rejects it. The final result is a list of all the ciphersuites and compressors accepted by the server.

In the meantime, both week Ciphers are not supported in the TLSv1.2 2023 kindly check in the document.

Predefined TLS policy, Configure TLS policy on a Front Door custom domain

Please try removing both week ciphers using the custom option and test it. In the meantime, are you checking the default URL of the front door. Once your domain setup is complete, you can check and let me know.

Check the screen shot hot manage with custom option:

Test with Nmap and see the CBC ciphers information. Check the below command:

nmap -sV --script ssl-enum-ciphers -p 443 <host>

Using Nmap for Testing:

Nmap can be used to scan an Azure Front Door endpoint and identify the supported cipher suites.

The ssl-enum-ciphers script within Nmap can be used for this purpose.

The output will show the cipher suites, their strength (graded A through F, with E being weak), and other details.

You can identify CBC-based ciphers in the output.

In the meantime, please check the previous reference thread: https://learn.microsoft.com/en-us/answers/questions/2225749/is-there-a-way-to-disable-weak-cipher-suites-in-az

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 1

Hello $@chin

I understand you're facing an issue with Azure Front Door, particularly with the reporting of weak cipher suites during a vulnerability assessment penetration test (VAPT).

Is Azure Front Door still using weak cipher suites despite the configured policy ?

Yes, Azure Front Door might still be using weak cipher suites. This can happen if:

However, the presence of weak ciphers reported may be due to client-side configurations or specific legacy protocols, rather than the Azure Front Door configuration itself.

The client (browser or tool) connecting to Azure Front Door supports weak ciphers and negotiates to use them. The configuration of Azure Front Door is not fully aligned with the expected policies due to caching or propagation delays.

If yes, what are the recommended steps to fully eliminate or mitigate these ciphers ?

Make sure you are using the latest version of Azure Front Door and check your backend resources to ensure they do not support weak ciphers.
Set up Azure Front Door with a custom TLS policy to explicitly disable any weak ciphers that might be set accidentally. Test the setup using external tools like SSL Labs to ensure it meets compliance standards.

Is this a limitation or expected behavior in Azure Front Door’s design ?

It is expected behavior that Azure Front Door implements strong cipher suites by default when configured. Any weak ciphers reported may be due to misconfigurations or clients that fall back on weak ciphers due to compatibility reasons. However, they also offer the ability to create custom policies for enhanced security measures.

If it is expected, should this be considered a security concern for our application ?

While Azure Front Door is designed to be secure with proper configuration, weak ciphers could expose your application to vulnerabilities. It's important to ensure that both Azure Front Door and your application backend are aligned in their cipher suite configurations. It is crucial to use only strong cipher suites and regularly review and update your security policies. Additionally, consider implementing security best practices such as using HSTS (HTTP Strict Transport Security) and keeping your software and dependencies up to date.

Check the public document for more understanding:

Azure Front Door TLS policy

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Share via

Azure front door shows weak ciphers

0 additional answers

Your answer