We're using this powershell script as our Azure Cloud Service (PaaS) startup script and we're at an A- on the Qualys SSL Labs test

Specifically we're losing points for the following reasons:

Forward Secrecy : With some browsers (more info)
Downgrade attack prevention : No, TLS_FALLBACK_SCSV not supported (more info)

We'd like to set it up for an A+ on that one (and improve other aspects not covered in that test). How can we do so?


First, for an analysis of TLS version and cipher suite selection, see my answer to Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment?

  • The summary is: TLS_DHE_* and TLS_ECDHE_* support PFS, but AVOID DSS, RC4, and so on.
  • The reason you're getting points off for not having FS with some browsers is the TLS_RSA_* cipher suites; take them out of your startup script.

Then, for an additional technical "how do I do this on Azure", please read How do I configure Perfect Forward Secrecy in Windows Azure (OS, or Websites)

As far as TLS_FALLBACK_SCSV goes, your best bet is to get all your friends to give your feedback to Microsoft regarding the TLS_FALLBACK_SCSV Connect entry

  • FYI the TLS_FALLBACK_SCSV issue you linked to in Connect is for I.E., but to get an A+ on the SSLLabs test it would need to be implemented in IIS instead.
    – Xander
    Jan 24 '15 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.