Support for TLS 1.3

[ehrw1n]

I am seeking support for enabling TLS 1.3 in Azure SignalR Service or guidance on any documentation steps I might have overlooked. Currently, the absence of TLS 1.3 support forces us to maintain our Azure Web App instance on TLS 1.2, which is the only barrier to achieving our enhanced security settings.

We are using version 8.0 on both the client and server, and have configured the client hub connection to permit TLS 1.3, but this has not resolved the issue. Does SignalR, whether self-hosted or on Azure, support TLS 1.3? Additionally, would upgrading to .NET 9.0 make a difference?

[vicancy]

Azure SignalR does support TLS1.3. You could validate this with openssl s_client -connect <hostname>:<port> -tls1_3.

What errors are you seeing when upgrading your Azure Web App instance to TLS 1.3?

[ehrw1n]

That's good to hear!

Inner Exception: Authentication failed because the remote party sent a TLS alert: 'ProtocolVersion'

After configuring the client to explicitly allow TLS versions 1.2|1.3, 1.2 or 1.3, connect still fails, but oddly the inner exception seemed to have disappeared.

[ehrw1n]

We also restrict cipher suites based on similar security considerations, outlined here:

TLS_AES_256_GCM_SHA384
TLS_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

[ehrw1n]

• Microsoft.AspNetCore.SignalR.Client 8.0.8
• Microsoft.Azure.SignalR 1.26.1

We hadn't updated to 8.0.11 and 1.28.0 yet, doing that today.

[ehrw1n]

openssl s_client -tls1_3 successfully connects to the web app and signalr instance. The service.signalr.net instance speaks TLS 1.2 and 1.3, which doesn't seem configurable.

[vicancy]

That's good to hear!

Inner Exception: Authentication failed because the remote party sent a TLS alert: 'ProtocolVersion'

After configuring the client to explicitly allow TLS versions 1.2|1.3, 1.2 or 1.3, connect still fails, but oddly the inner exception seemed to have disappeared.

Where is this error thrown from?

Yes the service supports both TLS1.2 and 1.3, it is the client side determining which to use.