Security: enforce TLS 1.2+ on public endpoints (ALB + CloudFront allow TLS 1.0/1.1)

[bjagg]

Summary

Cyber-insurance review flagged LIF public endpoints for allowing TLS 1.0/1.1, violating our encryption policy. Root cause: neither the shared ALB HTTPS listeners nor the CloudFront frontends pin a modern TLS floor, so both fall back to AWS defaults that still permit 1.0/1.1.

• ALBs (advisor.demo, dev.lif, demo.lif — dev/demo shared ALBs): the 443 listener in cloudformation/service-common.yml (LoadBalancerHttpsListener) sets no SslPolicy → defaults to ELBSecurityPolicy-2016-08 (permits TLS 1.0/1.1/1.2).
• CloudFront (mdr.dev, and any frontend built from cloudformation/s3-hosted.yml): the ViewerCertificate sets no MinimumProtocolVersion → custom-cert default TLSv1 (permits 1.0/1.1).
• lif.unicon.net (apex) does not resolve to LIF infra — not in this account; likely corporate unicon.net DNS. Needs confirmation with the insurer, not remediable here.

Fix

• ALB 443 listener → SslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06 (TLS 1.2 + 1.3 only).
• CloudFront ViewerCertificate → MinimumProtocolVersion: TLSv1.2_2021.

Rollout

Both are low-risk, no-downtime updates. Redeploy the affected stacks: {dev,demo}-lif-common (ALB listener) and each frontend's s3-hosted stack (CloudFront, ~minutes to propagate). Confirm after with SSL Labs or describe-listeners --query 'Listeners[].SslPolicy'.

[bjagg]

Reopening to track the rollout (the code change merged in #1120, but the change isn't fully live until deployed + verified).

Deploy status (2026-08-04):

• ✅ ALBs done — dev-lif-common + demo-lif-common redeployed; both 443 listeners now report ELBSecurityPolicy-TLS13-1-2-2021-06 (TLS 1.2/1.3 only). Covers advisor.demo, dev.lif, demo.lif + all API subdomains.
• ⏳ CloudFront pending — mdr.dev / mdr.demo are still TLSv1. They deploy via a CloudFormation StackSet (*-mdr-s3-hosted-stackset), so propagating the new MinimumProtocolVersion needs a StackSet update, not just a stack redeploy. In progress.