TLS Security Policy

Scenarios

HTTPS encryption is commonly used for applications that require secure transmission of data, such as banks and finance. When you add HTTPS listeners, you can select appropriate default security policies to improve security. A security policy is a combination of TLS protocols of different versions and supported cipher suites.

You can only select the default security policies for HTTPS listeners added to a shared load balancer.

Adding a Default Security Policy

1. Go to the load balancer list page.
2. On the displayed page, locate the load balancer and click its name.
3. Under Listeners, click Add Listener.
4. On the Add Listener page, set Frontend Protocol to HTTPS.
5. Expand Advanced Settings and select a default security policy.
   Table 1 lists the default security policies supported by shared load balancers.

   Table 1 Default security policies

   Name	TLS Versions	Cipher Suites
   TLS-1-0	TLS 1.2 TLS 1.1 TLS 1.0	ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 AES128-GCM-SHA256 AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA256 AES128-SHA256 AES256-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA ECDHE-ECDSA-AES256-SHA AES128-SHA AES256-SHA
   TLS-1-1	TLS 1.2 TLS 1.1
   TLS-1-2	TLS 1.2
   TLS-1-2-Strict	TLS 1.2	ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 AES128-GCM-SHA256 AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA256 AES128-SHA256 AES256-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384

   

   • Shared load balancers support TLS 1.2 or earlier versions.
   • The above table lists the cipher suites supported by ELB. Generally, clients also support multiple cipher suites. In actual use, the cipher suites supported by ELB and clients are used, and the cipher suites supported by ELB take precedence.
6. Confirm the configurations and go to the next step.

Differences Among Security Policies

Changing a Security Policy

When you change a security policy, ensure that the security group rules configured for backend servers allow traffic from 100.125.0.0/16 to backend servers and allows ICMP packets for UDP health checks. Otherwise, backend servers will be considered unhealthy, resulting in service interruptions.

1. Go to the load balancer list page.
2. On the displayed page, locate the load balancer and click its name.
3. Click Listeners, locate the listener, and click its name.
4. On the Summary tab, click Edit on the top right.
5. In the Edit dialog box, expand Advanced Settings and change the security policy.
6. Click OK.