Back-end TLS 1.3 question for everybody. We were looking to enable TLS 1.3 for back-end servers. We noticed when we enabled TLS1.3 as an option on the back-end, items that are TLS1.2 would go down. Doing a trace, we see the handshake and cert exchange and everything looks like it will be good for TLS 1.2. But then the NetScaler resets the session. It's like having the TLS 1.3 function enabled, along with TLS 1.2, the NetScaler wouldn't allow the lower connection. I know there is some re-negotiation changes with the TLS 1..3 spec, is this what we were running into? I am recommending the application owners update their back-end systems to support TLS 1.3. And once they do, then we can enable the policy. But is there anyway to create a universal back-end profile that supports TLS 1.3, like we did with TLS1.2 and TLS1.1?

Can you check your SSL Profile? --> It might be that the default setting for "Deny SSL Renegotiation" for a backend ssl profile is set to "ALL".

Yeah, we tried flipping that to all the options. No luck.

And is your backend Windows OS?

Some of them yes. If they are 2019 or newer, that can support tls1.3 but maybe don't have it enabled yet and are running tls 1.2 we saw it fail. For 2016 and older machines that were still using tls 1 and 1.1 they could use the new profile with 1.3 added, no problem. Seems to be something specific with tls1.2 sites.

Yeah I remember a lot of issues with Exchange in the past because of TLS1.2 as well. Hence my question, it might be that Windows doesn't like the renegotiation either.

That's what I was thinking. Is that there is something in the spec. Thanks for the sanity check. I'm crazy, just not about this.

I know we ran into issues attempting to enable TLS 1.3 against our on-prem Exchange 2016/2019 as well. IIRC, support for 1.3 wasn't coming until late '25.