Skip to content

Issue #1119: enforce TLS 1.2+ on ALB + CloudFront (drop TLS 1.0/1.1) #1120

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bjagg merged 1 commit into from
Aug 4, 2026
+10 −2
Merged

Issue #1119: enforce TLS 1.2+ on ALB + CloudFront (drop TLS 1.0/1.1) #1120

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions cloudformation/s3-hosted.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,10 @@ Resources:
ViewerCertificate:
AcmCertificateArn: !Ref SSLCertificate
SslSupportMethod: sni-only
# Pin TLS 1.2+ for viewers. Without this, a custom-cert distribution
# defaults to MinimumProtocolVersion TLSv1, which permits TLS 1.0/1.1
# (encryption-policy violation flagged by cyber insurance, 2026-08).
MinimumProtocolVersion: TLSv1.2_2021
Tags:
- Key: Name
Value: !Sub '${EnvironmentName}-${ServiceName}-cloudfront'
Expand Down
8 changes: 6 additions & 2 deletions cloudformation/service-common.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -488,9 +488,13 @@ Resources:
<a rel="home" title="404 Home" class="active" href="https://www.unicon.net/"><img class="logo" id="logo" alt="Unicon logo" title="Home" src="https://www.unicon.net/hs-fs/hubfs/raw_assets/public/Unicon_October2020/images/logo.png?width=600&name=logo.png"></a>
</div>
LoadBalancerArn: !Ref LoadBalancer
Port: 443
Port: 443
Protocol: HTTPS
Certificates:
# Pin TLS 1.2+1.3 only. Without an explicit policy the listener defaults to
# ELBSecurityPolicy-2016-08, which still permits TLS 1.0/1.1 (encryption-policy
# violation flagged by cyber insurance, 2026-08).
SslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06
Certificates:
- CertificateArn: !Ref SSLCertificate

SSLCertificate:
Expand Down
Loading