1

I have enabled TLS connection logging in my Azure cloud service to find out what TLS version my clients are using, following the guidance here - https://www.microsoft.com/security/blog/2017/09/07/new-iis-functionality-to-help-identify-weak-tls-usage/

However I notice quite a few entries with all the four fields set to empty. I see requests from few clients with the TLS1.2 (crypt-protocol = 400) and some requests from same clients with crypt-protocol set to empty. The volume is quite low, however I was wondering why would those entries be logged? My hunch is just an edge case or error case in IIS where it logs a default empty value. Or would it be because IIS was not able to figure out the protocol the connection is using?

I want to disable TLS versions older than 1.2 on my server and hence need to find out. Looking at the volume, I should probably be good to just disable, but wanted to see if the community has more insights and if this is due to genuine reasons, probably reach out to the clients to get it fixed before turning off older TLS versions.

Edit: The value is empty and not "-".

Saint
  • 3,977
  • 2
  • 11
  • 10
  • Is your issue solved? If your issue is solved then I request you to mark the helpful suggestion as an answer. This will help other people who face the same issue. If your issue still exists then try to refer the solution given by the community members. If then also you have any further questions then let us know about it. We will try to provide further suggestions to solve the issue. Thanks for your understanding. – Jalpa Panchal Sep 25 '20 at 01:43

2 Answers2

0

Below is the iis custom log field:

CRYPT_PROTOCOL

CRYPT_CIPHER_ALG_ID

CRYPT_HASH_ALG_ID

CRYPT_KEYEXCHANGE_ALG_ID

This functionality actually not supported by the Azure App Services.

Logging TLS related data in IIS logs for Azure App Service

https://www.microsoft.com/security/blog/2017/09/07/new-iis-functionality-to-help-identify-weak-tls-usage/

Jalpa Panchal
  • 8,251
  • 1
  • 11
  • 26
0

Make sure your website automatically redirects from HTTP to HTTPS, because HTTP requests will result in an empty crypt-protocol value. Which makes sense of course.

Zeep
  • 1