Does AGC FrontendTLSPolicy 2023-06 intentionally reject its documented RSA-CBC TLS 1.2 suites?

Naga Dheeraj BIDDALA 0 Reputation points
2026-09-15T13:59:58.8766667+00:00

I reproduced an Application Gateway for Containers TLS-policy discrepancy in a clean AKS managed-ALB deployment.

A valid RSA listener certificate and FrontendTLSPolicy predefined / 2023-06 are accepted and the Gateway is Programmed. RSA GCM negotiates successfully,

but both RSA-CBC suites listed in the 2023-06 documentation fail with TLS alert 40:

  • ECDHE-RSA-AES128-SHA256
  • ECDHE-RSA-AES256-SHA384

The same behavior occurs in our existing environment.

Is this an intentional AGC data-plane restriction, or is the 2023-06 cipher table outdated?

Documentation:

https://learn.microsoft.com/azure/application-gateway/for-containers/tls-policy

GitHub reproduction:
https://github.com/Azure/AKS/issues/5966

Azure Application Gateway
Azure Application Gateway

An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Allan Solomon Mejia 9,165 Reputation points
    2026-09-16T01:48:13.89+00:00

    Hi @Naga Dheeraj BIDDALA

    Based on the current Microsoft documentation, I don’t think we can say this is intentional behavior.

    The documented 2023-06 policy explicitly includes these TLS 1.2 RSA-CBC suites:

    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

    They appear enabled for 2023-06 and disabled for the stricter 2023-06-S policy. Protocols/ciphers not listed aren't supported, which makes including these two suites fairly explicit.

    Your reproduction also rules out several common causes: FrontendTLSPolicy is accepted, the Gateway reaches Programmed=True, the listener has an RSA certificate, and RSA-GCM negotiates successfully. The failure is specifically with the documented RSA-CBC suites. Your GitHub reproduction shows both failing with TLS alert 40 before the certificate is presented.

    So at this point, treat this as a likely AGC data-plane/documentation discrepancy rather than a certificate or Kubernetes configuration problem.

    I also see that you’ve already opened Azure/AKS issue #5966 with a clean reproduction. That issue is currently open and labeled bug, but Microsoft engineering hasn't yet confirmed whether the cause is policy enforcement or outdated documentation.

    Until Microsoft confirms the intended behavior, don’t rely on those two CBC suites being available with 2023-06, even though the documentation currently says they are.

    For workloads that require them for legacy TLS 1.2 clients, I’d also recommend opening an Azure support case and referencing AKS #5966, including the ALB resource ID, region, UTC timestamps, and OpenSSL results. That should allow the Application Gateway for Containers team to confirm the effective cipher configuration on the data plane.

    References:

    Application Gateway for Containers TLS policy documentation

    Azure/AKS issue #5966 – AGC FrontendTLSPolicy 2023-06 RSA-CBC behavior

    Help make this community better for everyone: If this answer helped or resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution. Thank you.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.