TLS Security Policy

Updated on 2024-04-19 GMT+08:00

View PDF

Scenarios

When you add HTTPS listeners, you can select appropriate security policies to improve security. A security policy is a combination of TLS protocols of different versions and supported cipher suites.

Dedicated load balancers: You can select the default security policy or create a custom policy. For details, see Creating a Custom Security Policy.
Shared load balancers: You can select the default security policy.

Adding a Security Policy

Log in to the management console.
In the upper left corner of the page, click and select the desired region and project.
Hover on in the upper left corner to display Service List and choose Network > Elastic Load Balance.
Locate the load balancer and click its name.
Under Listeners, click Add Listener.
In the Add Listener dialog box, set Frontend Protocol to HTTPS.

Expand Advanced Settings and select a security policy.

Table 1 shows the default security policies. Select a default security policy or create a custom security policy by referring to Creating a Custom Security Policy.

**Table 1** Default security policies
Security Policy	Description	TLS Versions	Cipher Suites
TLS-1-0	TLS 1.0, TLS 1.1, and TLS 1.2 and supported cipher suites (high compatibility and moderate security)	TLS 1.2 TLS 1.1 TLS 1.0	ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 AES128-GCM-SHA256 AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA256 AES128-SHA256 AES256-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA ECDHE-ECDSA-AES256-SHA AES128-SHA AES256-SHA
TLS-1-1	TLS 1.1 and TLS 1.2 and supported cipher suites (moderate compatibility and moderate security)	TLS 1.2 TLS 1.1
TLS-1-2	TLS 1.2 and supported cipher suites (moderate compatibility and high security)	TLS 1.2
TLS-1-0-Inherit	TLS 1.0, TLS 1.1, and TLS 1.2 and supported cipher suites (high compatibility and moderate security)	TLS 1.2 TLS 1.1 TLS 1.0	ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 AES128-GCM-SHA256 AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA256 AES128-SHA256 AES256-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-RSA-AES128-SHA DHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA ECDHE-ECDSA-AES256-SHA AES128-SHA AES256-SHA DHE-DSS-AES128-SHA CAMELLIA128-SHA EDH-RSA-DES-CBC3-SHA DES-CBC3-SHA ECDHE-RSA-RC4-SHA RC4-SHA DHE-RSA-AES256-SHA DHE-DSS-AES256-SHA DHE-RSA-CAMELLIA256-SHA
TLS-1-2-Strict	Strict TLS 1.2 and supported cipher suites (low compatibility and ultra-high security)	TLS 1.2	ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 AES128-GCM-SHA256 AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA256 AES128-SHA256 AES256-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384
TLS-1-0-WITH-1-3 (for dedicated load balancers)	TLS 1.0 and later, and supported cipher suites (ultra-high compatibility and low security)	TLS 1.3 TLS 1.2 TLS 1.1 TLS 1.0	ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 AES128-GCM-SHA256 AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA256 AES128-SHA256 AES256-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA ECDHE-ECDSA-AES256-SHA AES128-SHA AES256-SHA TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_CCM_SHA256 TLS_AES_128_CCM_8_SHA256
TLS-1-2-FS-WITH-1-3 (for dedicated load balancers)	TLS 1.2 and later, and supported forward secrecy cipher suites (high compatibility and ultra-high security)	TLS 1.3 TLS 1.2	ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384 TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_CCM_SHA256 TLS_AES_128_CCM_8_SHA256
TLS-1-2-FS (for dedicated load balancers)	TLS 1.2 and supported forward secrecy cipher suites (moderate compatibility and ultra-high security)	TLS 1.2	ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384
hybrid-policy-1-0 (dedicated load balancers)	TLS 1.1 and TLS 1.2 and supported cipher suites (moderate compatibility and moderate security)	TLS 1.2 TLS 1.1	ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 AES128-GCM-SHA256 AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA256 AES128-SHA256 AES256-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA ECDHE-ECDSA-AES256-SHA AES128-SHA AES256-SHA ECC-SM4-SM3 ECDHE-SM4-SM3
tls-1-2-strict-no-cbc (dedicated load balancers)	TLS 1.2 and supported cipher suites that exclude CBC encryption algorithm (low compatibility and ultra-high security)	TLS 1.2	ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256

NOTE:

TLS-1-0-WITH-1-3, TLS-1-2-FS-WITH-1-3, TLS-1-2-FS, hybrid-policy-1-0, and tls-1-2-strict-no-cbc are available only for dedicated load balancers.
The latest TLS version supported by dedicated load balancers is TLS 1.3, while the latest version supported by shared load balancers is TLS 1.2.
This table lists the cipher suites supported by ELB. Generally, clients also support multiple cipher suites. In actual use, the intersection of the cipher suites supported by ELB and those supported by clients is used, and the cipher suites supported by ELB take precedence.

Click OK.

Differences Between Security Policies

**Table 2** Differences between the security policies
Security Policy	TLS-1-0	TLS-1-1	TLS-1-2	TLS-1-2-Strict	TLS-1-0-WITH-1-3	TLS-1-2-FS-WITH-1-3	TLS-1-2-FS
TLS versions
TLS 1.3	-	-	-	-	√	√	√
TLS 1.2	√	√	√	√	√	√	√
TLS 1.1	√	√	-	-	√	-	-
TLS 1.0	√	-	-	-	√	-	-
Cipher suite
EDHE-RSA-AES128-GCM-SHA256	√	√	√	√	-	-	-
ECDHE-RSA-AES256-GCM-SHA384	√	√	√	√	√	√	√
ECDHE-RSA-AES128-SHA256	√	√	√	√	√	√	√
ECDHE-RSA-AES256-SHA384	√	√	√	√	√	√	√
AES128-GCM-SHA256	√	√	√	√	√	-	-
AES256-GCM-SHA384	√	√	√	√	√	-	-
AES128-SHA256	√	√	√	√	√	-	-
AES256-SHA256	√	√	√	√	√	-	-
ECDHE-RSA-AES128-SHA	√	√	√	-	√	-	-
ECDHE-RSA-AES256-SHA	√	√	√	-	√	-	-
AES128-SHA	√	√	√	-	√	-	-
AES256-SHA	√	√	√	-	√	-	-
ECDHE-ECDSA-AES128-GCM-SHA256	√	√	√	√	√	√	√
ECDHE-ECDSA-AES128-SHA256	√	√	√	√	√	√	√
ECDHE-ECDSA-AES128-SHA	√	√	√	-	√	-	-
ECDHE-ECDSA-AES256-GCM-SHA384	√	√	√	√	√	√	√
ECDHE-ECDSA-AES256-SHA384	√	√	√	√	√	√	√
ECDHE-ECDSA-AES256-SHA	√	√	√	-	√	-	-
ECDHE-RSA-AES128-GCM-SHA256	-	-	-	-	√	√	√
TLS_AES_256_GCM_SHA384	-	-	-	-	√	√	√
TLS_CHACHA20_POLY1305_SHA256	-	-	-	-	√	√	√
TLS_AES_128_GCM_SHA256	-	-	-	-	√	√	√
TLS_AES_128_CCM_8_SHA256	-	-	-	-	√	√	√
TLS_AES_128_CCM_SHA256	-	-	-	-	√	√	√

Creating a Custom Security Policy

Log in to the management console.
In the upper left corner of the page, click and select the desired region and project.
Hover on in the upper left corner to display Service List and choose Network > Elastic Load Balance.
In the navigation pane on the left, choose TLS Security Policies.
On the displayed page, click Create Custom Security Policy in the upper right corner.

Configure the parameters based on Table 3.

**Table 3** Custom security policy parameters
Parameter	Description	Example Value
Name	Specifies the name of the custom security policy.	tls-test
TLS Version	Specifies the TLS version supported by the custom security policy. You can select multiple versions: TLS 1.0 TLS 1.1 TLS 1.2 TLS 1.3	-
Cipher Suite	Specifies the cipher suites that match the selected TLS versions.	-
Description	Provides supplementary information about the custom security policy.	-

Click OK.

Modifying a Custom Security Policy

You can modify a custom security policy as you need.

Log in to the management console.
In the upper left corner of the page, click and select the desired region and project.
Hover on in the upper left corner to display Service List and choose Network > Elastic Load Balance.
In the navigation pane on the left, choose TLS Security Policies.
On the TLS Security Policies page, click Custom Security Policies, locate the custom security policy, and click Modify in the Operation column.
In displayed dialog box, modify the custom security policy as described in Table 3.
Click OK.

Deleting a Custom Security Policy

You can delete a custom security policy as you need.

Log in to the management console.
In the upper left corner of the page, click and select the desired region and project.
Hover on in the upper left corner to display Service List and choose Network > Elastic Load Balance.
In the navigation pane on the left, choose TLS Security Policies.
On the TLS Security Policies page, click Custom Security Policies, locate the custom security policy, and click Delete in the Operation column.
Click Yes.

Changing a Security Policy

When you change a security policy, ensure that the security group containing backend servers allows traffic from 100.125.0.0/16 to backend servers and allows ICMP packets for UDP health checks. Otherwise, backend servers will be considered unhealthy, and routing will be affected.

Log in to the management console.
In the upper left corner of the page, click and select the desired region and project.
Hover on in the upper left corner to display Service List and choose Network > Elastic Load Balance.
Locate the load balancer and click its name.
Click Listeners, locate the listener, and click its name.
On the Summary tab page, click Edit on the top right.
In the Modify Listener dialog box, expand Advanced Settings and change the security policy.
Click OK.