Minimum TLS version#
Security · Azure Database for MariaDB · Rule · 2022_12 · Critical
Azure Database for MariaDB servers should reject TLS versions older than 1.2.
Description#
The minimum version of TLS that Azure Database for MariaDB servers accept is configurable. Older TLS versions are no longer considered secure by industry standards, such as PCI DSS.
Azure lets you disable outdated protocols and require connections to use a minimum of TLS 1.2. By default, TLS 1.0, TLS 1.1, and TLS 1.2 is accepted.
Recommendation#
Configure the minimum supported TLS version to be 1.2.
Examples#
Configure with Azure template#
To deploy Azure Database for MariaDB Servers that pass this rule:
- Set the
properties.minimalTlsVersion
property toTLS1_2
.
For example:
Azure Template snippet
{
"type": "Microsoft.DBforMariaDB/servers",
"apiVersion": "2018-06-01",
"name": "[parameters('name')]",
"location": "[parameters('location')]",
"sku": {
"name": "[parameters('sku')]",
"tier": "GeneralPurpose",
"capacity": "[parameters('skuCapacity')]",
"size": "[format('{0}', parameters('skuSizeMB'))]",
"family": "Gen5"
},
"properties": {
"sslEnforcement": "Enabled",
"minimalTlsVersion": "TLS1_2",
"createMode": "Default",
"version": "10.3",
"administratorLogin": "[parameters('administratorLogin')]",
"administratorLoginPassword": "[parameters('administratorLoginPassword')]",
"publicNetworkAccess": "Disabled",
"storageProfile": {
"storageMB": "[parameters('skuSizeMB')]",
"backupRetentionDays": 7,
"geoRedundantBackup": "Enabled"
}
}
}
Configure with Bicep#
To deploy Azure Database for MariaDB Servers that pass this rule:
- Set the
properties.minimalTlsVersion
property toTLS1_2
.
For example:
Azure Bicep snippet
resource server 'Microsoft.DBforMariaDB/servers@2018-06-01' = {
name: name
location: location
sku: {
name: sku
tier: 'GeneralPurpose'
capacity: skuCapacity
size: '${skuSizeMB}'
family: 'Gen5'
}
properties: {
sslEnforcement: 'Enabled'
minimalTlsVersion: 'TLS1_2'
createMode: 'Default'
version: '10.3'
administratorLogin: administratorLogin
administratorLoginPassword: administratorLoginPassword
publicNetworkAccess: 'Disabled'
storageProfile: {
storageMB: skuSizeMB
backupRetentionDays: 7
geoRedundantBackup: 'Enabled'
}
}
}
Links#
- SE:07 Encryption
- TLS enforcement in Azure Database for MariaDB
- Set TLS configurations for Azure Database for MariaDB
- TLS encryption in Azure
- Preparing for TLS 1.2 in Microsoft Azure
- Azure deployment reference