Azure IoT Hub
An Azure service that enables bidirectional communication between internet of things (IoT) devices and applications.
IoT Hub with TLS 1.2 is accepting messages from devices without necessary cipher suites for some hours
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(12.8, 48%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMF%3C/text%3E%3C/svg%3E)
Markus Fischer
0
Reputation points
The Advantech WISE4010/LAN module provides above cipher suites. These are not compatible with azure IoT Hub TLS 1.2. After switching from TLS 1.0 to 1.2 on IoT Hub for testing, the module was able sending messages for some hours till connection error was shown on the module. After the first connection error on the module it reacted immediately to a TLS change on IoT hub. Which means when switching back to 1.0 it was able to send immediately and also stopped immediately after switching to 1.2 again. I want to know why this pattern happens to find out if other module will have problems after end of August when TLS 1.0 is stopped.
Azure IoT Hub
{count} votes
-
Manas Mohanty 8,320 Reputation points Microsoft External Staff Moderator2025-08-12T15:19:41.7333333+00:00 It seems you are facing issue after switching to TLS 1.2 and pointed out Cipher Suites which might not compatible with TLS 1.2.
Till Aug 31
The following non-recommended cipher suites are allowed on hubs without minTlsVersion:1.2 until August 31, 2025:
- TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_RSA_WITH_AES_256_GCM_SHA384
- TLS_RSA_WITH_AES_128_GCM_SHA256
- TLS_RSA_WITH_AES_256_CBC_SHA256
- TLS_RSA_WITH_AES_128_CBC_SHA256
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
- TLS_RSA_WITH_AES_128_CBC_SHA
- TLS_RSA_WITH_AES_256_CBC_SHA
Post Aug 31
Below CIPHER suites will be reinforced Post Aug 31
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
After Aug 31 2025, Azure IoT Hub will officially end support for TLS 1.0 and 1.1, and weak cipher suites will be blocked across all regions. This means:
- Devices that rely on TLS 1.0 will fail to connect.
- Modules using auto-negotiation (e.g., SIMCOM or Quectel modems) may default to TLS 1.0 and fail unless explicitly configured for TLS 1.2. [Azure HTTP...rosoft Q&A]
- Any device or service not updated to support TLS 1.2 with strong cipher suites will be impacted.
Recommendation
- Audit all device firmware and TLS configurations - Upgrade Devices and firmware for TLS 1.2
- Enable TLS 1.2 enforcement where possible.
- Test modules under enforced TLS 1.2 conditions now to catch failures early.
- Review dependencies on third-party services that may still use TLS 1.0.
- Reference thread -
https://learn.microsoft.com/en-us/azure/iot-hub/iot-hub-tls-support#update-iot-hub-to-tls-12-support
Thank you for understanding the stricter compliance on TLS that IOT hub is implementing to enhance security on larger scale.
Sign in to comment
Sign in to answer