Anti-DDoS:Modify the TLS security policy supported by a website

Prerequisites

A website configuration is added, and the Protocol Type of the website configuration includes HTTPS. For instructions, see Add a website configuration.

Modify the TLS security policy of an international standard HTTPS certificate

1. Log on to the Website Config page in the Anti-DDoS Proxy console.

2. In the top navigation bar, select the region of your instance.

   • Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.

   • Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.

3. On the Website Config page, find the target domain name. In the Actions column, click Edit.

4. On the Modify Website Configurations tab, modify the TLS Security Settings of the international standard HTTPS certificate.

   Parameter	Description
   TLS Versions for SSL Certificate	Select the TLS versions that the international standard HTTPS certificate supports. Valid values: TLS 1.0 and later. This setting provides the best compatibility but low security.: supports TLS 1.0, TLS 1.1, and TLS 1.2. TLS 1.1 and later. This setting provides good compatibility and medium security.: supports TLS 1.1 and TLS 1.2. TLS 1.2 and later. This setting provides good compatibility and high security level.: supports TLS 1.2. Note You can also turn on TLS 1.3 support as needed and select the matching TLS 1.3 cipher suites in Custom Cipher Suite.
   Cipher Suites for SSL Certificate	Select the cipher suites that the international standard HTTPS certificate supports. Note You can hover over the icon of a cipher suite option to view the cipher suites that the option includes. All cipher suites. This setting provides low security but high compatibility. (Default) This option includes the following cipher suites: ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA256 AES256-SHA256 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-SHA AES256-SHA DES-CBC3-SHA Enhanced cipher suites. This setting provides a very high security level but a very low compatibility. This option is available only when TLS Version is set to TLS 1.2 and later. This setting provides good compatibility and high security level.. This option includes the following cipher suites: ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 Strong cipher suites. This setting provides a high security level but a low compatibility. This option is available only when TLS version is set to TLS 1.2 and later. This setting provides good compatibility and high security level.. This option includes the following cipher suites: ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA Custom Cipher Suite After you select this option, select one or more cipher suites from all available cipher suites. If you turn on the TLS 1.3 switch, select the following cipher suites: TLS_AES_256_GCM_SHA384 (TLS 1.3) TLS_CHACHA20_POLY1305_SHA256 (TLS 1.3) TLS_AES_128_GCM_SHA256 (TLS 1.3) TLS_AES_128_CCM_8_SHA256 (TLS 1.3) TLS_AES_128_CCM_SHA256 (TLS 1.3)

5. Click Next and follow the on-screen instructions to complete the modification.

FAQ

• Does Anti-DDoS Proxy verify the HTTPS certificate status of backend servers?

  No, it does not.

  An Anti-DDoS Proxy instance does not verify the validity of the HTTPS certificates on backend servers, such as ALB, WAF, or origin ECS instances. The verification includes checks for expiration, domain name matching, and issuer trustworthiness. How it works:

  • Frontend SSL/TLS termination: When a client establishes an HTTPS connection with Anti-DDoS Proxy, Anti-DDoS Proxy completes the SSL/TLS handshake and decrypts the traffic at the frontend.

  • Backend forwarding in plaintext or with re-encryption: The decrypted traffic is forwarded to the backend server over HTTP, or over a new HTTPS connection based on your configuration.

  • Certificate independence: TLS termination occurs on the Anti-DDoS Proxy side, so the communication security of the backend link does not depend on the certificate status of the backend server. Therefore, even if the certificate of the backend server has expired, is self-signed, or is invalid, HTTPS communication between the client and Anti-DDoS Proxy is established as expected as long as the frontend certificate on Anti-DDoS Proxy is valid. Business access is not affected.

  Note

  Although Anti-DDoS Proxy does not verify backend certificates, as a best practice, use valid and trusted certificates on backend servers to ensure end-to-end security. This is especially important when HTTPS origin fetching is enabled between Anti-DDoS Proxy and the backend server.

• What do I do if an SSL security scanner reports a 3DES-related vulnerability?

  If an SSL security scanner reports a 3DES-related vulnerability (for example, the scanner detects DES-CBC3-SHA), the cipher suite list that is currently configured includes this weak encryption algorithm. DES-CBC3-SHA is based on the 3DES algorithm, which the industry considers insecure and vulnerable to attacks such as Sweet32.

  Solutions:

  1. Switch to a preset cipher suite (recommended).
     In the Anti-DDoS Proxy console, switch the cipher suite configuration of the HTTPS certificate to “Strong Cipher Suites” or “Enhanced Cipher Suites”. Neither preset option includes DES-CBC3-SHA, so you can quickly fix the vulnerability.
     

  2. Customize cipher suites.
     To retain specific cipher suites, select “Custom Cipher Suite” and manually clear DES-CBC3-SHA from the list. Make sure that the remaining cipher suites use modern secure algorithms, such as AES-GCM or CHACHA20.
     

  If the scanner still reports the vulnerability after you change the configuration, check the following:

  • Verify that the configuration takes effect: Log on to the Anti-DDoS Proxy console and check whether the cipher suites that are actually bound to the current instance have been updated to the target configuration.

  • Clear the scanner cache: Some scanning tools cache historical results. Clear the cache and run the scan again.

  • Rule out false positives: Make sure that the scan target is the IP address of Anti-DDoS Proxy rather than the backend server, and check whether the scanning tool reports logical false positives.