TLS Security Policy

Scenarios

Adding a Default Security Policy

1. Log in to the management console.
2. In the upper left corner of the page, click and select the desired region and project.
3. Click in the upper left corner to display Service List and choose Network > Elastic Load Balance.
4. On the displayed page, locate the load balancer and click its name.
5. Under Listeners, click Add Listener.
6. On the Add Listener page, set Frontend Protocol to HTTPS.
7. Expand Advanced Settings and select a default security policy.

   Table 1 lists the default security policies supported by shared load balancers.

   Table 1 Default security policies

   Name	TLS Versions	Cipher Suites
   tls-1-0	TLS 1.2 TLS 1.1 TLS 1.0	ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 AES128-GCM-SHA256 AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA256 AES128-SHA256 AES256-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA ECDHE-ECDSA-AES256-SHA AES128-SHA AES256-SHA
   tls-1-1	TLS 1.2 TLS 1.1
   tls-1-2	TLS 1.2
   tls-1-2-strict	TLS 1.2	ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 AES128-GCM-SHA256 AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA256 AES128-SHA256 AES256-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384
   tls-1-2-fs	TLS 1.2	ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384

   Note

   • Shared load balancers support TLS 1.2 or earlier versions.
   • The above table lists the cipher suites supported by ELB. Generally, clients also support multiple cipher suites. In actual use, the cipher suites supported by ELB and clients are used, and the cipher suites supported by ELB take precedence.

8. Confirm the configurations and go to the next step.

Differences Between Security Policies

Changing a Security Policy

1. Log in to the management console.
2. In the upper left corner of the page, click and select the desired region and project.
3. Click in the upper left corner to display Service List and choose Network > Elastic Load Balance.
4. On the displayed page, locate the load balancer and click its name.
5. Click Listeners, locate the listener, and click its name.
6. On the Summary tab, click Edit on the top right.
7. In the Edit dialog box, expand Advanced Settings and change the security policy.
8. Click OK.