Use Secure Tls Policy | Vulnerability Database

You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.

The SSL policy is outdated and has known vulnerabilities

Follow the appropriate remediation steps below to resolve the issue.

Log into the AWS Management Console.
Select the “Services” option and search for EC2.
In the “EC2 Dashboard” scroll down and look for “Load Balancers” and click on “Load Balancers” to get into “Load Balancers” dashboard.
Select the “Load Balancer” which needs to be verified.
Select the “Listeners” tab from the bottom panel and scroll down to the “Cipher” column of HTTPS Listener and click on “Change” option.
From “Select a Cipher” panel select either of “Predefined Security Policy” and “Custom Security Policy”.
Scan the “SSL Cipher Section” from selected “Security Policy” for any insecure ciphers. Refer to the link for all secure ciphers. https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-ssl-security-policy.html#ssl-ciphers
Scroll down and click on “Save” button to make the changes.

Use a more recent TLS/SSL policy for the load balancer

1
2
3
4


resource "aws_alb_listener" "good_example" {
  ssl_policy = "ELBSecurityPolicy-TLS-1-2-2017-01"
  protocol = "HTTPS"
}