Retirement: Azure Front Door and Azure CDN profiles will end support for DHE cipher suites on April 1, 2026

As part of our ongoing commitment to security, Azure Front Door (Standard, Premium, Classic) and Azure CDN from Microsoft (Classic) services will no longer support weak cipher suites TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 and TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 on April 1 2026 for both ‘client to service’ connections and ‘service to origin’ connections.

Required action

To ensure uninterrupted service and maintain strong encryption standards, take the following actions:

1. Update your origins to disable DHE ciphers and use any of the recommended cipher suites. Follow our documentation to see how to update cipher suites for some of the common origin types used with Azure Front Door/Azure CDN.
2. Inform your clients to only use the recommended ciphers while connecting to your domains hosted on Azure Front Door/Azure CDN. If you own any of the clients, update them to use the recommended ciphers.
3. For Front Door Standard/Premium profiles, you can also use the Configure Azure Front Door TLS policy feature to disable the DHE ciphers in advance before 1 April 2026. For all Front Door (Standard, Premium, Classic) and Azure CDN from Microsoft (Classic) profiles, we will disable the DHE ciphers after April 1 2026.

Help and support

For more information and guidance regarding DHE cipher retire, refer to our documentation.

If you have questions, get answers from community experts in Microsoft Q&A. If you have a support plan and need technical help, please submit a support request .