[Bug][Application Gateway for Containers] FrontendTLSPolicy 2023-06 rejects documented RSA-CBC cipher suites

[nagabiddala]

Describe the bug

Application Gateway for Containers rejects the two RSA-CBC TLS 1.2 cipher suites documented as enabled by predefined FrontendTLSPolicy 2023-06.

The behavior reproduces in both an existing deployment and a newly created AKS cluster using the managed Application Gateway for Containers add-on.

The listener uses a valid RSA wildcard certificate. RSA-GCM cipher negotiation succeeds, but both documented RSA-CBC cipher suites fail with TLS alert 40.

Suggested label: app-gateway-for-containers

To Reproduce

1. Create an AKS cluster with the managed Application Gateway for Containers add-on in a supported region.

2. Create an ApplicationLoadBalancer.

3. Create an HTTPS Gateway listener with an RSA certificate stored in a Kubernetes TLS Secret.

4. Attach this policy to the HTTPS listener:

   apiVersion: alb.networking.azure.io/v1
   kind: FrontendTLSPolicy
   spec:
     targetRef:
       group: gateway.networking.k8s.io
       kind: Gateway
       name: cipher-gateway
       sectionNames:
       - https
     default:
       policyType:
         type: predefined
         name: 2023-06
   

5. Confirm the Gateway is Accepted=True and Programmed=True.

6. Test directly against the AGC frontend hostname while sending the Gateway hostname as SNI.

   Positive control succeeds:

   openssl s_client -brief
   -connect ":443"
   -servername ""
   -tls1_2
   -cipher ECDHE-RSA-AES128-GCM-SHA256

   Both documented 2023-06 RSA-CBC suites fail:

   openssl s_client -brief
   -connect ":443"
   -servername ""
   -tls1_2
   -cipher ECDHE-RSA-AES128-SHA256

   openssl s_client -brief
   -connect ":443"
   -servername ""
   -tls1_2
   -cipher ECDHE-RSA-AES256-SHA384

Expected behavior

With a valid RSA listener certificate and predefined policy 2023-06, both RSA-CBC suites should negotiate successfully:

• TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
• TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

Microsoft documentation lists both suites as enabled by 2023-06 and disabled only by 2023-06-S:

https://learn.microsoft.com/azure/application-gateway/for-containers/tls-policy

Actual behavior

Both RSA-CBC tests fail before a certificate is presented:

ssl/tls alert handshake failure
SSL alert number 40

The effective TLS 1.2 behavior appears equivalent to 2023-06-S, despite the applied policy being 2023-06.

Screenshots

Not applicable. OpenSSL output and Kubernetes resource status can be provided if needed.

Environment

• Region: North Europe
• AKS networking: Azure CNI
• Deployment method: AKS managed Application Gateway for Containers add-on
• TLS policy API: alb.networking.azure.io/v1
• Certificate type: RSA wildcard certificate stored in a Kubernetes TLS Secret
• Kubernetes version:
• Azure CLI version:
• aks-preview extension version:

Additional context

The reproduction connects directly to the AGC frontend hostname and supplies the Gateway hostname with TLS SNI. Public DNS is not required for the cipher
test.

Please confirm whether this is an intentional AGC data-plane restriction, a documentation discrepancy, or a defect in 2023-06 policy enforcement.

[microsoft-github-policy-service]

Jack Stromberg (@JackStromberg) would you be able to assist?

[nagabiddala]

Hello Jack Stromberg (@JackStromberg)
Could you please help me in this issue?