Use Secure Tls Policy | Vulnerability Database

An outdated SSL policy is in use by a load balancer.

You should not use outdated/insecure TLS versions for encryption. You should be using TLS v1.2+.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Use a more recent TLS/SSL policy for the load balancer

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


Resources:
  myLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer

  GoodExample:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref myLoadBalancer
      Protocol: HTTPS
      SslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06

Remediation Links

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-elasticloadbalancingv2-listener.html

Log in to the AWS Management Console.
Select the “Services” option and search for EC2.
In the “EC2 Dashboard” scroll down and look for “Load Balancing” and click on “Load Balancers” to get into “Load Balancers” dashboard.
Select the “Load Balancer” which needs to be verified.
Select the “Listeners” tab from the bottom panel and scroll down to the “Cipher” column of HTTPS Listener and click on “Change” option.
If you are using a “Predefined Security Policy” select the latest from the dropdown.
If you are using “Custom Security Policy” then ensure that only the recommended ciphers are used. Refer to the link for all secure ciphers. https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-ssl-security-policy.html#ssl-ciphers
Scroll down and click on “Save” button to make the changes.

Use a more recent TLS/SSL policy for the load balancer

1
2
3
4
5
6
7


resource "aws_lb" "example" {}

resource "aws_alb_listener" "good_example" {
  load_balancer_arn = aws_lb.example.arn
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  protocol          = "HTTPS"
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lb_listener