TLS Security Policy

When your deployed business needs to provide services to internet users, HTTPS encryption is generally used to ensure the secure transmission of data. For the HTTPS scenario, the security policy function provides the ability to configure the minimum version of the TLS protocol and the encryption algorithm suite. When creating and configuring HTTPS listening, you can bind your own security policy to ensure the security of your business and achieve the necessary security requirements.

Predefined Policy

Predefined policies do not support editing and deleting. The encryption suites and TLS protocols supported by the currently supported eight predefined policies are shown in the following table.

Differences between predefined policies, see the following table

Explanation:

1. The maximum protocol version of TLS can support up to TLSv1.3. If using TLSv1.3 for negotiation, the corresponding default encryption suite is:

• TLS_AES_128_GCM_SHA256
• TLS_AES_256_GCM_SHA384
• TLS_CHACHA20_POLY1305_SHA256

2. In addition to the six predefined policies in the table above, there are the following two. Their encryption algorithm suite is consistent with the native policy:

• security-tls12o, only TLS version change, minimum version 1.2
• security-tls11o, only TLS version change, minimum version 1.1

3. The high-security policy in the predefined policy supports the encryption suite in the ALB environment, which is equivalent to the syntax

ALL:!NULL:!aNULL:!DSS:!RC4:!RC2:!EXP:!LOW:!SSLv3:!CAMELLIA:!ARIA:!3DES:!DH:!DHE:!RSA

4. The medium-security policy in the predefined policy supports the encryption suite in the ALB environment, which is equivalent to the syntax

ALL:!NULL:!aNULL:!DSS:!RC4:!RC2:!EXP:!LOW:!SSLv3:!CAMELLIA:!ARIA:!3DES:!DH:!DHE

Custom Policy

You can define the policy you need by combining the minimum version of the TLS protocol and the encryption algorithm suite.

Create Custom Policy

1. Log in to the Application Load Balancer (ALB) Console.
2. Select Security Policy Management.

3. On the Security Policy List page, click Create Security Group Policy.

4. In the Create Security Policy dialog, complete the following parameter configuration, and click Create after the configuration is complete.

5. Once the custom policy is created, you can select the custom policy in the advanced settings when creating HTTPS listening.

Delete Single Custom Security Policy

1. Log in to the Application Load Balancer (ALB) Console.
2. Select Security Policy Management.

3. On the Security Policy List page, select the custom security policy you want to delete and click Delete.

4. In the second confirmation pop-up window, confirm whether it is the security policy you want to delete.

5. Click OK to complete the deletion operation.

Bulk Delete Custom Security Policies

1. Log in to the Application Load Balancer (ALB) Console.
2. Select Security Policy Management.

3. On the Security Policy List page, batch select the checkboxes on the left of the security policies you want to delete, and click delete above.

4. In the second confirmation pop-up window, confirm whether it is the security policy you want to delete.

5. Click OK to complete the deletion operation.

If you want to delete a custom policy, you must first unbind VServer before you can delete it.

Edit Custom Security Policy

You can update custom security group policies as needed.

1. Log in to the Application Load Balancer (ALB) Console.

2. Select Security Policy Management.

3. On the Security Policy List page, select the custom policy you want to edit and click edit in the operation bar.

4. Set the following information in the Edit Security Group Policy dialog box:

5. Click OK after the modification to complete the editing operation.