How to disable SSL v 3.0 on Azure Website

Question

I have a website that is hosted on Microsoft Azure Websites. It runs only in HTTPS and has a IP certificate. How do I disable SSL v 3.0 protocol on an Azure Website and only allow TLS 1.x ?

The website is running Asp.Net MVC 5 and .Net framework 4.5

Answer 1

Update (11/1/2014): SSLv3 is now completely disabled on Azure Websites. You no longer need to install the Site Extension mentioned below.

---

You can now disable SSLv3 on Azure Websites. This post has the details.

Basically, you just need to install the DisableSSLv3 site extension into your site, and restart the site.

To verify that it's in fact disabled, try running:

curl -sslv3 https://{yoursite}.azurewebsites.net/

And make sure you get a 403.

Answer 2

EDIT: SSL v3 is now disabled by default with Azure Websites, see here

This is currently not possible (server side) with Azure Websites.

But the Azure team is working on offering the option to disable SSL v.3 according to David Ebbo (@davidebbo) who is a Microsoft dev lead working on Azure Websites.

See conversions on twitter in the link below and response from David. (thanks to Jon Sagara) https://twitter.com/nirmsk/status/522423884922884097

Answer 3

As per this article (see update), from October 27th 2014, SSL 3.0 is disabled through all Azure Web-Sites. So we don't need to take any actions! Yay!