search

microsoft / azure-container-apps

Roadmap and issues for Azure Container Apps
MIT License
362 stars 29 forks source link

Feature Request: Enable TLS cipher suites compatible with older OS #572

Open italoaguiar opened 1 year ago

italoaguiar commented 1 year ago

This issue is a: (mark with an x)

Issue description

I'm trying to establish a connection to a container application within a Windows Forms application, but I'm getting the error "The request was aborted: Could not create SSL/TLS secure channel".

Using the SSL Labs tool it was possible to find out that the TLS cipher algorithms supported by the container application are:

But these cipher algorithms are not supported on older operating systems.

Steps to reproduce

  1. Go to an older OS (Win 7, Win 8 or Windows Server 2012)
  2. Make a web request to the container app or use the " Invoke-WebRequest" powershell command

Expected behavior [What you expected to happen.] A connection must be successfully established.

Actual behavior [What actually happened.] I'm getting the error "The request was aborted: Could not create SSL/TLS secure channel".

Additional context

Kubernetes has settings to modify the cipher algorithms used, but this setting is not available in azure container apps. tlsCipherSuites: [TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, ... ]

npehrsson commented 1 year ago

This is very important for my organization. Any updates and ETA on this.

italoaguiar commented 1 year ago

@npehrsson In our organization we have done a workaround by putting an Azure Front Door in front of all containers to manage certificates

npehrsson commented 1 year ago

@npehrsson In our organization we have done a workaround by putting an Azure Front Door in front of all containers to manage certificates

Thank you for the suggestion, Our need is however Websockets which Azure Front Door doesn't have support for. Our specific use case is controlling multiple brands of EV Charging Stations which are communicating through Web sockets.

The specification of OCPP which is being used has an older cipher in it. In my mind, this restriction makes ACA hard to use in IoT solutions where it's widespread with older operative systems installed on the devices.

magohl commented 1 year ago

Our need is however Websockets which Azure Front Door doesn't have support for.

Could Azure Application Gateway be an alternative to Front Door maybe?

We had the same issue but were lucky that it (so far) was only one client affected so we put an NGINX on the client side. But we are also really hoping they will fix this soon.

npehrsson commented 1 year ago

Could be, but costly, at the moment we're considering using CloudFlare proxy. Could cost a bit as well, but believe it will be cheaper in the end.