Answers: <p>Not sure if this is the right answer but let me give it a try with the limited knowledge i have on this.</p>
  
  <ol>
  <li><p>these are the resources that I found when I am looking up for tls enabling for my app service. please see if any of this works.
  <a href="https://docs.microsoft.com/en-us/windows/win32/secauthn/cipher-suites-in-schannel?redirectedfrom=MSDN" rel="nofollow noreferrer">msdn</a>
  <a href="https://docs.microsoft.com/en-us/azure/app-service/environment/app-service-app-service-environment-custom-settings#change-tls-cipher-suite-order" rel="nofollow noreferrer">how to configure ciphersuite for app service</a>
  <a href="https://docs.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-ssl#enforce-tls-versions" rel="nofollow noreferrer">enforce tls vrsion</a></p></li>
  <li><p>The client (browser) gives a list of cipher suites it can handle to the server and the server selects one, the decision is passed on to the client during the handshake.</p></li>
  <li><p>so all the servers won't accept all the cipher suites, it based on server config to choose.</p></li>
  </ol>
  
Answers: CC BY-SA 4.0
Answers: 2019-10-09T03:41:06.377Z
Answers: 2019-10-09T03:41:06.377Z
Answers: Venkata Sri Harsha Vemuluru
Body: <p>I am looking for a way to reliably check accepted cipher suites by an Azure App Service. On standard virtual machine I just remote to it and execute PowerShell command: <code>Get-TlsCipherSuite</code> which provides a list of currently accepted keys or check the system's registry.</p>
  
  <p>I could pen test app service by ssllabs.com however I cross checked their results against results from <code>Get-TlsCipherSuite</code> for a certain machine and it's not 100% accurate: ssllabs didn't detect suites with Pre Shared Keys.</p>
  
  <p>My questions:</p>
  
  <ul>
  <li><p>how to query Azure App Service accepted cipher suite?</p></li>
  <li><p>how do browsers know which cipher suites are available to it when it tries to go to a given domain?</p></li>
  <li><p>if that's not obvious out of answers to previous questions why ssllabs doesn't detect suites using PSK?</p></li>
  </ul>
  
Tags: <azure><encryption><ssl>
Title: How to check accepted cipher suites by an Azure App Service?
UserDisplayName: Yoda
ThreadText: # How to check accepted cipher suites by an Azure App Service?
  
  (Asked by: username_0 on 2019-10-04)
  
  I am looking for a way to reliably check accepted cipher suites by an Azure App Service. On standard virtual machine I just remote to it and execute PowerShell command: `Get-TlsCipherSuite` which provides a list of currently accepted keys or check the system's registry.
  
  I could pen test app service by ssllabs.com however I cross checked their results against results from `Get-TlsCipherSuite` for a certain machine and it's not 100% accurate: ssllabs didn't detect suites with Pre Shared Keys.
  
  My questions:
  
  * how to query Azure App Service accepted cipher suite?
  * how do browsers know which cipher suites are available to it when it tries to go to a given domain?
  * if that's not obvious out of answers to previous questions why ssllabs doesn't detect suites using PSK?
  
  **Tags:** azure, encryption, ssl
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-10-09. Score: 1
  
  Not sure if this is the right answer but let me give it a try with the limited knowledge i have on this.
  
  1. these are the resources that I found when I am looking up for tls enabling for my app service. please see if any of this works.
     [msdn](https://docs.microsoft.com/en-us/windows/win32/secauthn/cipher-suites-in-schannel?redirectedfrom=MSDN)
     [how to configure ciphersuite for app service](https://docs.microsoft.com/en-us/azure/app-service/environment/app-service-app-service-environment-custom-settings#change-tls-cipher-suite-order)
     [enforce tls vrsion](https://docs.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-ssl#enforce-tls-versions)
  2. The client (browser) gives a list of cipher suites it can handle to the server and the server selects one, the decision is passed on to the client during the handshake.
  3. so all the servers won't accept all the cipher suites, it based on server config to choose.
  
  
  ---
  
  