Scoring A+ for SSL Labs on My Cloudfront-Hosted Static Website

Another Security Castle!

I previously covered how I scored A+ for security headers on my site, which uses AWS CloudFront. I didn’t touch on scoring A+ for your TLS configuration though.

The industry standard checker for this is Qualys SSL Labs. As I discovered on Twitter yesterday, it now caps your grade at a B if you leave the deprecated TLS 1.0 or 1.1 enabled.

CloudFront are generally good at securing the default configuration, for example by removing broken cipher suites. I think my site was previously an A+ - but with this change, the default configuration is now capped at B.

Disabling TLS 1.0 and 1.1 will lock out very old browsers, but that’s normally worth it. Support will be removed from all major browsers in March 2020.

Without a custom domain name, it seems you can only use TLS 1.0, as the docs state:

If the distribution uses the CloudFront domain name such as d111111abcdef8.cloudfront.net (you set CloudFrontDefaultCertificate to true), CloudFront automatically sets the security policy to TLSv1 regardless of the value that you set here.

Thankfully my site uses a custom domain name. I ran the scanner on my site and saw that measly B:

Ugh, a B!

Fixing it

To fix it, I needed to change what the console sensibly calls the distribution’s Security Policy:

Security Policy selector

In the API it’s called MinimumProtocolVersion in the ViewerCertificate configuration.

(Confusingly the console recommends TLSv1.1_2016 while the linked documentation recommends TLSv1.2_2018. I think there’s some internal lag for changing copy at AWS.)

I use CloudFormation to configure my site resources. The syntax there mimics the API. I thus needed to set the DistributionConfig.ViewerCertificate.MinimumProtocolVersion property in my Cloudformation template. This looked like:

CloudfrontDistribution:
  Type: AWS::CloudFront::Distribution
  Properties:
    DistributionConfig:
      Aliases:
      - adamj.eu
      Comment: adamj.eu
      # ...
      ViewerCertificate:
        AcmCertificateArn: !Ref Certificate
        MinimumProtocolVersion: TLSv1.2_2018
        SslSupportMethod: sni-only

After deploying this change, I’m back to an A+!

Yay, A+!

Further Reading

Fin

I hope this helps you improve your site’s security,

—Adam

Read my book Boost Your Git DX to Git better.

Subscribe via RSS, Twitter, Mastodon, or email:

One summary email a week, no spam, I pinky promise.

Related posts:

Tags: ,