How to check accepted cipher suites by an Azure App Service?

Question

I am looking for a way to reliably check accepted cipher suites by an Azure App Service. On standard virtual machine I just remote to it and execute PowerShell command: Get-TlsCipherSuite which provides a list of currently accepted keys or check the system's registry.

I could pen test app service by ssllabs.com however I cross checked their results against results from Get-TlsCipherSuite for a certain machine and it's not 100% accurate: ssllabs didn't detect suites with Pre Shared Keys.

My questions:

• how to query Azure App Service accepted cipher suite?

• how do browsers know which cipher suites are available to it when it tries to go to a given domain?

• if that's not obvious out of answers to previous questions why ssllabs doesn't detect suites using PSK?

Answer 1

Not sure if this is the right answer but let me give it a try with the limited knowledge i have on this.

1. these are the resources that I found when I am looking up for tls enabling for my app service. please see if any of this works. msdn how to configure ciphersuite for app service enforce tls vrsion

2. The client (browser) gives a list of cipher suites it can handle to the server and the server selects one, the decision is passed on to the client during the handshake.

3. so all the servers won't accept all the cipher suites, it based on server config to choose.