Production devices disconnected from Azure IoT Hub - deprecated TLS 1.2 cipher no longer accepted

Greg Melson 5 Reputation points
2026-07-03T09:09:07.8166667+00:00

We respectfully request the following:

  1. Please investigate whether any TLS, cipher suite, certificate chain, or security policy changes were implemented on or around July 1, 2026 that could affect legacy TLS 1.2 clients.
  2. Please confirm whether strong cipher suite enforcement has changed or is now being enforced differently.
  3. If operationally possible, temporarily remove or relax the strong cipher suite enforcement, or restore the June 30, 2026 cipher compatibility, while maintaining TLS 1.2.
  4. If this is not technically possible, please provide the exact list of required TLS 1.2 cipher suites, certificate requirements, and any other security changes required so that we can validate our firmware.

Please any guidance on how to formally request a temporary cipher compatibility exception or extended transition period while we roll out new firmware

Azure IoT Hub
Azure IoT Hub

An Azure service that enables bidirectional communication between internet of things (IoT) devices and applications.

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Christos Panagiotidis 3,301 Reputation points
    2026-07-15T08:07:33.8033333+00:00

    There is no supported per-hub rollback or exception for weak cipher suites now. IoT Hub retired TLS 1.0/1.1 and non-recommended ciphers on August 31, 2025; changing minTlsVersion cannot restore them.

    Supported TLS 1.2 suites are ECDHE_ECDSA or ECDHE_RSA with AES_128_GCM_SHA256, AES_256_GCM_SHA384, AES_128_CBC_SHA256, or AES_256_CBC_SHA384. The ClientHello must also contain a valid supported_groups extension for ECDHE.

    Capture a failing ClientHello to confirm the offered suites and groups. If the firmware only supports a TLS_RSA_* suite, the durable fix is updated firmware or device replacement. A temporary, isolated gateway that accepts the legacy device connection and reconnects to IoT Hub with a supported ECDHE suite is the practical bridge during rollout.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.