Azure Front Door TLS policy

Applies to: ✔️ Front Door Standard ✔️ Front Door Premium

Azure Front Door supports end-to-end TLS encryption. When you add a custom domain to Azure Front Door, you must use HTTPS, and you need to define a TLS policy that includes control of the TLS protocol version and the cipher suites during a TLS handshake.

Azure Front Door supports two versions of the TLS protocol: TLS versions 1.2 and 1.3. Currently, Azure Front Door doesn't support client/mutual authentication (mTLS).

Azure Front Door Standard and Premium offer two mechanisms for controlling TLS policy. You can use either a predefined policy or a custom policy based on your own needs.

• Azure Front Door offers several predefined TLS policies. You can configure Azure Front Door with any of these policies to get the appropriate level of security. The Microsoft Security team configures these predefined policies based on best practices and recommendations. Use the newest TLS policies to ensure the best TLS security.
• If you need to configure a TLS policy for your own business and security requirements, use a Custom TLS policy. By using a custom TLS policy, you have complete control over the minimum TLS protocol version to support.

For a minimum TLS version 1.2, the negotiation process first attempts to establish TLS 1.3 and then TLS 1.2. The client must support at least one of the supported ciphers to establish an HTTPS connection with Azure Front Door. Azure Front Door chooses a cipher in the listed order from the client-supported ciphers.

When Azure Front Door initiates TLS traffic to the origin, it attempts to negotiate the best TLS version that the origin can reliably and consistently accept. Supported TLS versions for origin connections are TLS 1.2 and TLS 1.3.

Predefined TLS policy

Azure Front Door offers several predefined TLS policies. You can configure Azure Front Door with any of these policies to get the appropriate level of security. The policy names include the minimum TLS versions and the year in which they were configured (TLSv1.2_2023>). Each policy offers different TLS protocol versions and cipher suites. The Microsoft Security team configures these predefined policies based on best practices and recommendations. Use the newest TLS policies to ensure the best TLS security.

The following table shows the list of minimum protocol version support for each predefined policy.

By default, Azure Front Door selects TLSv1.2_2023. TLSv1.2_2022 maps to the minimum TLS 1.2 version in previous design.

Custom TLS policy

If you need to configure a TLS policy for your requirements, use a custom TLS policy. By using a custom TLS policy, you have complete control over the minimum TLS protocol version to support.

Next step