Azure Front Door and Weak Cypher

Question

Azure Front Door and Weak Cypher

Nick Diaz 281

In Azure Application Gateway we can disable weak cypher so how to disable weak cypher for Azure Front door we are a payment gateway merchant and this is essential to meet our qualys certification

Answer 1

Luis Rodriguez 6,126 Microsoft Employee

Hello @Nick Diaz

Welcome to Microsoft Q&A Platform,

You should be able to do it from the Front Door custom domain settings, please refer to the thread below as it's related to the same topic:

https://learn.microsoft.com/en-us/answers/questions/202490/how-to-remove-weak-ciphers-from-tls-12-configurati.html

I hope this helps!

----------

Please don’t forget to "Accept the answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Nick Diaz 281 Reputation points

2022-06-15T14:52:13.347+00:00

This doesn’t give an option to disable particular weak ciphers from AFD.

What we need is to just enable these ciphers below in Azure Front Door. (TLS 1.2 also exhibits few weak ciphers, we don’t need all ciphers from TLS1.2)

Cipher suites
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_CBC_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA256
Nick Diaz 281 Reputation points

2022-06-16T11:31:06.9+00:00

Any update on this ?
Jason Lee 131 Reputation points

2022-12-07T20:51:40.03+00:00

Hi @Luis Rodriguez , my project has also been flagged due to the same issue. Could you please confirm if there is indeed no solution to this at the moment and if this feature is in the backlog of the Front Door team?

Here is a link to the issue description of the tool that flagged this issue for my project.
https://www.invicti.com/web-vulnerability-scanner/vulnerabilities/weak-ciphers-enabled/

Thanks

Answer 2

Warren Hughes 1

Hi @Nick Diaz did you end up finding a workaround for this missing feature?

Answer 3

Actually, I think I just found the answer we were looking for here.

Azure Front Door doesn’t support configuring specific cipher suites. You can get your own custom TLS/SSL certificate from your Certificate Authority (For example: Verisign, Entrust, or DigiCert). Then have specific cipher suites marked on the certificate when you generate it.

It would be great to have a Front Door feature where this was configurable.

Azure Front Door and Weak Cypher

3 answers

Activity