Prepare for upcoming TLS 1.3 support for Azure Storage

Azure Storage has started to enable TLS 1.3 support on public HTTPS endpoints across its platform globally to align with security best practices. Azure Storage currently supports TLS 1.0, 1.1 (scheduled for deprecation by November 2024), and TLS 1.2 on public HTTPS endpoints. This blog provides additional guidance on how to prepare for upcoming support for TLS 1.3 for Azure Storage. 

TLS 1.3 introduces substantial enhancements compared to its predecessors. TLS 1.3 improvements focus on both performance and security, featuring faster handshakes and a streamlined set of more secure cipher suites, namely TLS_AES_256_GCM_SHA384 and TLS_AES_128_GCM_SHA256. Notably, TLS 1.3 prioritizes Perfect Forward Secrecy (PFS) by eliminating key exchange algorithms that don't support it. 

Clients that utilize the latest available TLS version will automatically pick TLS 1.3 when it is available. If you need more time to upgrade to TLS 1.3, you can choose to continue to use TLS 1.2 by controlling the TLS negotiations through client configuration (see recommendations section below). Azure storage will continue to support TLS 1.2 in addition to TLS 1.3. 

We have outlined below some of the known issues with TLS 1.3 enablement, potential impact and mitigation. 

Known Issues, impact and mitigation  

Certain Java clients can experience high latencies, timeouts, and connections that hang for extended periods due to a bug in the Java Http stack. The issue manifests primarily for applications with high request concurrency. The bugs are [JDK-8293562] and [JDK-8208526] . 

The major JDK versions with the bug fixes are: 

1. JDK 11 (> 11.0.17) 
2. JDK 17 (> 17.0.6) 
3. JDK 21 

The following categories of clients could be affected while using TLS 1.3: 

1. Clients that run on JDK versions other than JDK versions mentioned above. 
2. Client tools like WASB and Azure Storage SDK for Java < v12 running the JDK version without the fix. (Note: ABFS, Azure Storage Java SDK > V12 are not impacted). 

Recommendations for mitigation: 

Option 1: (Recommended) Upgrade your application to the latest supported JDK versions mentioned above or latest Azure Storage SDK for Java. You can refer to the following link to get the latest recommended SDK versions. 

Option 2: (Short-term workaround) We understand it might not always be possible to upgrade to the latest SDK version. While you move your application to the latest SDK version, this can be mitigated by setting the maximum TLS version for client versions to TLS 1.2. There are two ways to accomplish this: 

1. Setting system properties when invoking the Java application: 
    
   java -Djdk.tls.client.protocols=TLSv1.2 -Dhttps.protocols=TLSv1.2 -jar ... 
    
2. Setting system properties in code: 
    
   System.setProperty("Djdk.tls.client.protocols”, "TLSv1.2"); 
   System.setProperty("Dhttps.protocols”, "TLSv1.2"); 

When your applications are ready to work with TLS 1.3, remember to reset these settings. 

Help and Support 

If you have questions, get answers from community experts in Microsoft Q&A. If you have a support plan and you need technical help, create a support request:  

For Issue type, select Technical.  

For Subscription, select your subscription.  

For Service, select My services.  

For Service type, select Blob Storage.  

For Resource, select the Azure resource you are creating a support request for.  

For Summary, type a description of your issue.  

For Problem type, select Connectivity.  

For Problem subtype, select Issues using TLS.