{"id":9580,"date":"2025-02-20T09:20:50","date_gmt":"2025-02-20T17:20:50","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/cosmosdb\/?p=9580"},"modified":"2025-03-03T09:49:54","modified_gmt":"2025-03-03T17:49:54","slug":"moving-to-tls-1-2-for-azure-cosmos-db-ensuring-secure-connections","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/cosmosdb\/moving-to-tls-1-2-for-azure-cosmos-db-ensuring-secure-connections\/","title":{"rendered":"Moving to TLS 1.2 for Azure Cosmos DB: Ensuring Secure Connections"},"content":{"rendered":"

Security and reliability are at the core of modern cloud applications. To strengthen data protection and align with industry best practices, we encourage all Azure Cosmos DB customers to transition to <\/span><\/span>TLS 1.2<\/span><\/span><\/span><\/a>.<\/span> This post explains why this change is important, how to make the transition, and the benefits it brings to your applications.<\/span><\/span><\/p>\n

Why Move to TLS 1.2?<\/span><\/span>\u00a0<\/span><\/h4>\n

Transport Layer Security (TLS) is a critical <\/span>component<\/span> in securing data transmitted over networks. TLS 1.2 offers enhanced security features compared to its predecessors, TLS 1.0 and 1.1. By moving to TLS 1.2<\/span> or later<\/span>, you ensure that your data is protected with the latest encryption standards<\/span>, including perfect forward secrecy and stronger cipher suites.<\/span><\/span>\u202f<\/span><\/span>\u00a0<\/span><\/p>\n

Current Situation<\/span><\/span>\u00a0<\/span><\/h4>\n

Currently, Azure Cosmos DB allows the use of TLS versions lower than 1.2. However, to enhance security, we recommend that all customers enforce TLS 1.2 on their <\/span>Azure <\/span>Cosmos DB accounts. This change is crucial as it aligns with industry best practices and ensures that your data <\/span>remains<\/span> secure.<\/span><\/span><\/p>\n

Challenges<\/span><\/span><\/h4>\n

We understand that a <\/span>significant number<\/span> of <\/span>Azure <\/span>Cosmos DB customers still use TLS versions lower than 1.2. <\/span>S<\/span>udden enforcement of TLS 1.2 could lead to disruptions in your applications. Therefore, we are implementing a phased approach to minimize any potential impact.<\/span><\/span><\/p>\n

Proposed Solution<\/span><\/span><\/h4>\n

Use the Service Retirement Workbook<\/a> to monitor your Azure Cosmos DB accounts with less than TLS 1.2. To address these challenges, <\/span>you can use our self-serve feature. <\/span>This allows you to set the <\/span>minimum<\/span> TLS version for your <\/span>Azure <\/span>Cosmos DB accounts through the Azure portal. By doing so, you can gradually transition to TLS 1.2 without disrupting your existing workflows.<\/span><\/span><\/p>\n

Implementation<\/span>\u00a0<\/span><\/h4>\n

Starting with the 2022-11-15 API version of the Azure Cosmos DB Resource Provider API, a new property called\u202f<\/span>minimalTlsVersion<\/span>\u202f<\/span>is available for every Azure Cosmos DB database account.\u00a0<\/span>\u00a0<\/span><\/p>\n

This property accepts values Tls12 and above, with the default value for new accounts set to\u202fTls12.<\/span>\u00a0<\/span><\/p>\n

Important Dates<\/span>\u00a0<\/span><\/h4>\n