TLS Security Policies

When your deployed business needs to provide services for internet users, HTTPS encryption is generally used to ensure the secure transmission of data. For the HTTPS scenario, the security policy function provides the ability to configure the minimum version of the TLS protocol and the encryption algorithm suite. When creating and configuring HTTPS listening, you can bind your own security policy to ensure the security of your business and achieve the necessary security requirements.

Predefined Policies

Predefined policies cannot be edited or deleted. The encryption suites and TLS protocols supported by the current eight predefined policies are shown in the following table.

Differences between predefined policies, see the following table

Explanation:

1. The maximum protocol version of TLS can support up to TLSv1.3. If using TLSv1.3 for negotiation, the corresponding default encryption suite is:

• TLS_AES_128_GCM_SHA256
• TLS_AES_256_GCM_SHA384
• TLS_CHACHA20_POLY1305_SHA256

2. In addition to the six predefined policies in the table above, there are the following two. Their encryption algorithm suite is consistent with the native policy:

• security-tls12o, only TLS version change, minimum version 1.2
• security-tls11o, only TLS version change, minimum version 1.1

3. The encryption suite supported by the high-security policy in the predefined policies is in the ALB environment, which is equivalent to the syntax.

ALL:!NULL:!aNULL:!DSS:!RC4:!RC2:!EXP:!LOW:!SSLv3:!CAMELLIA:!ARIA:!3DES:!DH:!DHE:!RSA

4. The encryption suite supported by the high-security policy in the predefined policies is in the ALB environment, which is equivalent to the syntax.

ALL:!NULL:!aNULL:!DSS:!RC4:!RC2:!EXP:!LOW:!SSLv3:!CAMELLIA:!ARIA:!3DES:!DH:!DHE

Custom Policies

You can define the policy you need by combining the minimum version of the TLS protocol and the encryption algorithm suite.

Create Custom Policy

1. Log in to the ALB Console.
2. Select Security Policy Management.

3. On the Security Policy List page, click Create Security Policy.

4. In the Create Security Policy dialog, complete the following parameter configuration, and click OK after the configuration is complete.

5. Once the custom policy is created, you can configure the custom policy in the advanced settings when creating HTTPS listening.

Delete Single Custom Security Policy

1. Log in to the ALB Console.
2. Select Security Policy Management.

3. On the Security Policy List page, select the custom security policy you want to delete and click Delete.

4. In the second confirmation pop-up window, confirm whether it is the security policy you want to delete.

5. Click “Confirm” to complete the deletion.

Bulk Delete Custom Security Policies

1. Log in to the ALB Console.
2. Select Security Policy Management.

3. On the Security Policy List page, batch select the checkboxes on the left of the security policies you want to delete, and click “Delete” above.

4. In the second confirmation pop-up window, confirm whether they are the security policies you want to delete.

5. Click Confirm to complete the deletion.

If you want to delete a custom policy, you must first unbind VServer before you can delete it.

Edit Custom Security Policies

You can update custom security policies as needed.

1. Log in to the ALB Console.

2. Select Security Policy Management.

3. On the Security Policy List page, select the custom policy you want to edit and click “Edit” in the operation bar.

4. Set the following information in the “Edit Security Group Policy” dialog box:

5. Click OK after the modification to complete the editing operation.