Classic Load Balancer listener should use a secure configuration
Description
Use a secure protocol and cipher to protect communication between the client and your Classic Elastic Load Balancers (ELBs). TLS 1.0 and 1.1 are vulnerable to attacks due to multiple insecurities, for this reason we recommend the use of ELBSecurityPolicy-TLS-1-2-2017-01 which authorizes TLS 1.2.
Rationale
Insecure communication channels increase the risk of attacks, such as man-in-the-middle, downgrade attacks, and sensitive data breaches. It is recommended to configure listeners to use HTTPS, or SSL, and ELBSecurityPolicy-TLS-1-2-2017-01, or a custom policy with an equivalent or more secure configuration. TLS on port 443 will generate a pass condition for this rule only if a secure policy is attached to the listener.
Protocol and cipher details
This configuration check tests for a listener configured using HTTPS, SSL, or TLS on port 443, as well as for the absence of ciphers and protocols for secure listener configurations that are not recommended by AWS.
It is recommended to modify listeners configured to use TLS on port 443, to HTTPS on port 443, and select a secure policy.
From the console
- Follow the Create an HTTPS/SSL load balancer using the console documentation to learn how to create an HTTPS/SSL load balancer in the AWS console.
- Follow the Update the SSL negotiation configuration using the console documentation to apply
ELBSecurityPolicy-TLS-1-2-2017-01 or a Custom Security Policy that is as or more secure.
From the command line
- Follow the Create an HTTPS/SSL load balancer using the AWS CLI documentation to learn how to create an HTTPS/SSL load balancer in the AWS command line.
- Follow the Update the SSL negotiation configuration using the console documentation to apply
ELBSecurityPolicy-TLS-1-2-2017-01 or a Custom Security Policy that is as or more secure.
