{"id":63575,"date":"2022-03-15T03:04:49","date_gmt":"2022-03-15T11:04:49","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/devops\/?p=63575"},"modified":"2022-10-17T00:10:44","modified_gmt":"2022-10-17T08:10:44","slug":"deprecating-weak-cryptographic-standards-tls-1-0-and-1-1-in-azure-devops-services","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/devops\/deprecating-weak-cryptographic-standards-tls-1-0-and-1-1-in-azure-devops-services\/","title":{"rendered":"Deprecating weak cryptographic standards (TLS 1.0 and 1.1) in Azure DevOps Services"},"content":{"rendered":"<p><div class=\"alert alert-primary\"><p class=\"alert-divider\"><i class=\"fabric-icon fabric-icon--Info\"><\/i><strong>Update (October 2022): Deprecation of weak cryptographic protocols has completed.<\/strong><\/p><\/p>\n<p>Deprecation of TLS 1.0 and 1.1 has completed for the dev.azure.com and *.visualstudio.com domains &#8211; all HTTPS connections to Azure DevOps for these domains now use TLS 1.2. <\/div><\/p>\n<p>Azure DevOps team needed to partially rollback the previous release of TLS 1.0\/1.1 deprecation that was run on <strong>Jan 31st, 2022<\/strong>. This was due to unexpected issues caused by the change. Here&#8217;s a <a href=\"https:\/\/devblogs.microsoft.com\/devops\/deprecating-weak-cryptographic-standards-tls-1-0-and-tls-1-1-in-azure-devops\/\">link<\/a> to the previous blog post related to that release.<\/p>\n<p>TLS 1.0\/1.1 deprecation applies to all HTTPS connections to Azure DevOps Services including web API, and git connections to <strong>https:\/\/dev.azure.com\/orgname<\/strong> and <strong>https:\/\/orgname.visualstudio.com<\/strong>. This does not apply and will not impact the Self-Hosted product: Azure DevOps Server.<\/p>\n<p>Currently, connections to IPv6 endpoints of our services are already on enforced TLS 1.2 so the deprecation is targeting <strong>IPv4<\/strong> endpoints only.<\/p>\n<p>We anticipate minimal impacts to our customers as more than 99.5% of connections made to Azure DevOps Services already use TLS 1.2. Clients have TLS 1.2-compatibility issues because of obsolete OS version or if available updates are not applied (applies for all Windows, macOS and Linux) or legacy .NET Framework installation or OS configuration prohibiting certain TLS cipher suites.<\/p>\n<h2>Important Dates<\/h2>\n<p>To help our customers identify Azure DevOps-facing TLS 1.2-incompatible software in their systems, we will temporarily disable support for TLS 1.0\/1.1 for 12 hours on:<\/p>\n<ul>\n<li>\n<p><strong>March 22, 2022 09:00 to 21:00 UTC<\/strong> for https:\/\/orgname.visualstudio.com. TLS 1.0\/1.1 connections to Azure DevOps Services using https:\/\/orgname.visualstudio.com will temporarily fail to connect. Connections using https:\/\/dev.azure.com on TLS 1.0\/1.1 will not be impacted.<\/p>\n<\/li>\n<li>\n<p><strong>March 24, 2022 09:00 to 21:00 UTC<\/strong> for https:\/\/dev.azure.com\/orgname. TLS 1.0\/1.1 connections to Azure DevOps Services using https:\/\/dev.azure.com\/orgname will temporarily fail to connect. Connections using https:\/\/orgname.visualstudio.com on TLS 1.0\/1.1 will not be impacted.<\/p>\n<\/li>\n<\/ul>\n<p>We will be starting permanent rollout from <strong>March 31, 2022<\/strong><\/p>\n<h2>How to enable TLS 1.2?<\/h2>\n<p>As a key area of focus we recommend Self-Hosted Agents and tooling that calls Azure DevOps Services APIs.<\/p>\n<p>Check these red flags first when looking for TLS 1.2-incompatible flows: &#8211; Windows Server 2012 R2 or lower used &#8211; .NET Framework 4.7+ not installed on computer where PowerShell or .NET applications call Azure DevOps API<\/p>\n<p>It is key that on the OS one of the four TLS 1.2 cipher suites below is enabled:<\/p>\n<ul>\n<li>TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384<\/li>\n<li>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256<\/li>\n<li>TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (*)<\/li>\n<li>TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (*)<\/li>\n<\/ul>\n<p><strong><em>NOTE:<\/em><\/strong> (*) Cipher suites supported by Windows Server 2012 R2<\/p>\n<h2>Quick check of TLS 1.2 compatibility<\/h2>\n<p>Following checks are based on querying site <a href=\"https:\/\/status.dev.azure.com\">status.dev.azure.com<\/a>. For this domain, the TLS 1.0\/1.1 protocols have already been deprecated. Note that checking accessibility of this domain by browser instead of PowerShell is not equivalent. Browsers often use crypto libraries (such as OpenSSL) and thus circumvent the classic HTTP\/TLS stack that other software uses.<\/p>\n<h3>Manual PowerShell<\/h3>\n<p>Run this code in PowerShell console:<\/p>\n<pre><code>(Invoke-WebRequest -Uri status.dev.azure.com -UseBasicParsing).StatusDescription\n<\/code><\/pre>\n<p>You have the problem if the above fails with &#8220;The underlying connection was closed: An unexpected error occurred on a send.&#8221;<\/p>\n<h3>YAML<\/h3>\n<p>To check your pipeline agents: create testing pipeline OR add this step to existing pipelines:<\/p>\n<pre><code>steps:\n  - task: AzurePowerShell@5\n    inputs:\n      ScriptType: 'InlineScript'\n      Inline: '\"TLS 1.2 readiness check:\"; (Invoke-WebRequest -Uri status.dev.azure.com -UseBasicParsing).StatusDescription'\n      FailOnStandardError: true\n<\/code><\/pre>\n<h3>Pipeline task<\/h3>\n<p>This shows a release pipeline task that can be added to perform a check for TLS 1.2 readiness on your Self-Hosted Agents. If the check fails, the task will throw an error that can be actioned.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/devblogs.microsoft.com\/devops\/wp-content\/uploads\/sites\/6\/2022\/03\/pipelinetask5.png\" alt=\"Pipeline Task\" \/><\/p>\n<h2>Troubleshooting<\/h2>\n<p>For Windows OS, TLS 1.2 is natively supported by all versions from Windows 7 \/ Windows Server 2008 SP2. However, even at TLS 1.2-compatible OS, issues may be caused by misconfigurations such as when all cipher suites accepted by Azure DevOps are disabled. This may be set up locally or via domain Group Policies.<\/p>\n<p>At application level, capabilities provided by the OS may be narrowed down making the app to use less secure TLS setting. For example, .NET apps which are built against legacy .NET Framework versions may require certain measures to be taken to ensure that TLS 1.2 is favoured.<\/p>\n<p>Based on learnings from supporting our customers, we&#8217;ve put together a troubleshooting script which performs TLS 1.2 probe, identifies most common misconfigurations and provides mitigation advice.<\/p>\n<p>You can find the script on GitHub:<\/p>\n<p><a href=\"https:\/\/github.com\/microsoft\/azure-devops-tls12\" rel=\"noopener\" target=\"_blank\">https:\/\/github.com\/microsoft\/azure-devops-tls12<\/a><\/p>\n<p>The project is work in progress; feel free to contribute with PR or open an issue.<\/p>\n<h2>Conclusion<\/h2>\n<p>We apologize for any disruption this may cause and appreciate your support to improve our security posture. As always, if you have any questions or concerns related to this announcement, please do not hesitate to reach out to us on <a href=\"https:\/\/developercommunity.visualstudio.com\/search?space=21\">Developer Community<\/a> or by posting your comments below.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Azure DevOps team needed to partially rollback the previous release of TLS 1.0\/1.1 deprecation that was run on Jan 31st, 2022. This was due to unexpected issues caused by the change. Here&#8217;s a link to the previous blog post related to that release. TLS 1.0\/1.1 deprecation applies to all HTTPS connections to Azure DevOps Services [&hellip;]<\/p>\n","protected":false},"author":85535,"featured_media":45953,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[224],"tags":[],"class_list":["post-63575","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure"],"acf":[],"blog_post_summary":"<p>Azure DevOps team needed to partially rollback the previous release of TLS 1.0\/1.1 deprecation that was run on Jan 31st, 2022. This was due to unexpected issues caused by the change. Here&#8217;s a link to the previous blog post related to that release. TLS 1.0\/1.1 deprecation applies to all HTTPS connections to Azure DevOps Services [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/posts\/63575","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/users\/85535"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/comments?post=63575"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/posts\/63575\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/media\/45953"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/media?parent=63575"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/categories?post=63575"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/devops\/wp-json\/wp\/v2\/tags?post=63575"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}