Modify the TLS security policy for your website

Prerequisites

You must add a website configuration and set its Protocol Type to include HTTPS. For more information, see Add a Website Configuration.

Modify the TLS security policy

1. Log on to the Website Config page in the Anti-DDoS Proxy console.

2. In the top navigation bar, select the region of your instance.

   • Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.

   • Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.

3. On the Website Config page, find the target domain name and click Edit in the Actions column.

4. On the Modify Website Configurations tab, modify the TLS Security Settings for the international standard HTTPS certificate.

   Parameter	Description
   TLS Versions for SSL Certificate	Select the TLS protocol versions supported by the international standard HTTPS certificate. The following options are available: TLS 1.0 and later. This setting provides the best compatibility but low security.: Supports TLS 1.0, TLS 1.1, and TLS 1.2. TLS 1.1 and later. This setting provides good compatibility and medium security.: Supports TLS 1.1 and TLS 1.2. TLS 1.2 and later. This setting provides good compatibility and high security level.: Supports TLS 1.2. Note You can also enable TLS 1.3 support and select the corresponding TLS 1.3 suites from the Custom Cipher Suite options.
   Cipher Suites for SSL Certificate	Select the cipher suites for the international standard HTTPS certificate. Note You can hover over the icon next to an option to view the included cipher suites. All cipher suites. This setting provides low security but high compatibility. This option includes the following cipher suites: ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 AES128-GCM-SHA256 AES256-GCM-SHA384 AES128-SHA256 AES256-SHA256 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-RSA-AES128-SHA ECDHE-RSA-AES256-SHA AES128-SHA AES256-SHA DES-CBC3-SHA Enhanced cipher suites. This setting provides a very high security level but a very low compatibility. This option is available only when TLS Version is set to TLS 1.2 and later. This setting provides good compatibility and high security level.. This option includes the following cipher suites: ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 Strong cipher suites. This setting provides a high security level but a low compatibility. This option is available only when TLS versions for HTTPS certificate is set to TLS 1.2 and later. This setting provides good compatibility and high security level.. This option includes the following cipher suites: ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA Custom Cipher Suite After selecting this option, choose one or more cipher suites from the complete list. If you enabled TLS 1.3 support, select the following suites: TLS_AES_256_GCM_SHA384 (TLS 1.3) TLS_CHACHA20_POLY1305_SHA256 (TLS 1.3) TLS_AES_128_GCM_SHA256 (TLS 1.3) TLS_AES_128_CCM_8_SHA256 (TLS 1.3) TLS_AES_128_CCM_SHA256 (TLS 1.3)

5. Click Next and follow the on-screen instructions to complete the update.

FAQ

• Does Anti-DDoS Proxy validate the HTTPS certificate status of backend servers?

  No, it does not.

  Anti-DDoS Proxy instances do not validate the validity of HTTPS certificates on backend servers (such as ALB, WAF, or origin ECS instances). This includes checks for expiration, domain name matching, or issuer trustworthiness. The mechanism works as follows:

  • Frontend SSL/TLS Termination: When a client establishes an HTTPS connection with the Anti-DDoS Proxy instance, the instance completes the SSL/TLS handshake and decrypts the traffic at the frontend.

  • Backend Forwarding (Plaintext or Re-encryption): The decrypted traffic is forwarded to the backend server via HTTP, or re-encrypted via HTTPS depending on your configuration.

  • Certificate Independence: Since TLS termination occurs at the Anti-DDoS Proxy layer, the security of the backend link does not depend on the certificate status of the backend server. Therefore, even if the backend server’s certificate is expired, self-signed, or invalid, the HTTPS communication between the client and the Anti-DDoS Proxy instance will establish normally as long as the frontend certificate on the Anti-DDoS Proxy instance is valid. Business access remains unaffected.

  Note

  Although Anti-DDoS Proxy does not validate backend certificates, we recommend using valid and trusted certificates on backend servers to ensure end-to-end security, especially when HTTPS origin fetching is enabled between the protection instance and the backend.

• What should I do if an SSL security scanner reports a 3DES-related vulnerability?

  If an SSL security scanner reports a 3DES-related vulnerability (e.g., detecting DES-CBC3-SHA), it indicates that your current cipher suite configuration includes this weak algorithm. DES-CBC3-SHA is based on the 3DES algorithm, which has been deemed insecure by the industry and is vulnerable to attacks such as Sweet32.

  Solutions:

  1. Switch to Preset Cipher Suites (Recommended)
     In the Anti-DDoS Proxy console, switch the HTTPS certificate cipher suite configuration to "Strong Cipher Suites" or "Enhanced Cipher Suites." These preset configurations exclude DES-CBC3-SHA and can quickly resolve the vulnerability.

  2. Customize Cipher Suites
     If you need to retain specific ciphers, select "Custom Cipher Suites" and manually uncheck DES-CBC3-SHA from the list. Ensure that the remaining suites use modern secure algorithms (such as AES-GCM or CHACHA20).

  If the vulnerability persists after configuration changes, troubleshoot the following:

  • Verify Configuration Application: Log in to the Anti-DDoS Proxy console and confirm that the cipher suite configuration currently applied to the instance has been updated to the target settings.

  • Clear Scanner Cache: Some scanning tools cache historical results. Clear the cache and re-run the scan.

  • Rule Out False Positives: Ensure that the scan target is the Anti-DDoS Proxy IP address (not the backend origin server directly) and check if the scanning tool has any logical false positives.