When you create or configure an HTTPS listener for a high-performance Classic Load Balancer (CLB) instance, you can select a Transport Layer Security (TLS) security policy.

Select a TLS security policy

When you create or configure an HTTPS listener, click Advanced on the SSL Certificates wizard page and select a TLS policy from the drop-down list. For more information, see Add an HTTPS listener. Configure a listener

TLS security policies

A TLS security policy contains TLS protocol versions and cipher suites that are available for HTTPS. A later TLS version offers higher security but comprises compatibility with browsers.

Security policy Supported TLS version Supported cipher suite
tls_cipher_policy_1_0 TLS 1.0, TLS 1.1, and TLS 1.2 ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES128-SHA256, ECDHE-ECDSA-AES256-SHA384, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES128-SHA256, ECDHE-RSA-AES256-SHA384, AES128-GCM-SHA256, AES256-GCM-SHA384, AES128-SHA256, AES256-SHA256, ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES256-SHA, ECDHE-RSA-AES128-SHA, ECDHE-RSA-AES256-SHA, AES128-SHA, AES256-SHA, and DES-CBC3-SHA
tls_cipher_policy_1_1 TLS 1.1 and TLS 1.2 ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES128-SHA256, ECDHE-ECDSA-AES256-SHA384, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES128-SHA256, ECDHE-RSA-AES256-SHA384, AES128-GCM-SHA256, AES256-GCM-SHA384, AES128-SHA256, AES256-SHA256, ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES256-SHA, ECDHE-RSA-AES128-SHA, ECDHE-RSA-AES256-SHA, AES128-SHA, AES256-SHA, and DES-CBC3-SHA
tls_cipher_policy_1_2 TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES128-SHA256, ECDHE-ECDSA-AES256-SHA384, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES128-SHA256, ECDHE-RSA-AES256-SHA384, AES128-GCM-SHA256, AES256-GCM-SHA384, AES128-SHA256,AES256-SHA256, ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES256-SHA, ECDHE-RSA-AES128-SHA, ECDHE-RSA-AES256-SHA, AES128-SHA, AES256-SHA, and DES-CBC3-SHA
tls_cipher_policy_1_2_strict TLSv1.2 ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES128-SHA256, ECDHE-ECDSA-AES256-SHA384, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES128-SHA256, ECDHE-RSA-AES256-SHA384, ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES256-SHA, ECDHE-RSA-AES128-SHA, and ECDHE-RSA-AES256-SHA
tls_cipher_policy_1_2_strict_with_1_3 TLS 1.2 and TLS 1.3 TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_AES_128_CCM_SHA256, TLS_AES_128_CCM_8_SHA256, ECDHE-ECDSA-AES128-GCM-SHA256, ECDHE-ECDSA-AES256-GCM-SHA384, ECDHE-ECDSA-AES128-SHA256, ECDHE-ECDSA-AES256-SHA384, ECDHE-RSA-AES128-GCM-SHA256, ECDHE-RSA-AES256-GCM-SHA384, ECDHE-RSA-AES128-SHA256, ECDHE-RSA-AES256-SHA384, ECDHE-ECDSA-AES128-SHA, ECDHE-ECDSA-AES256-SHA, ECDHE-RSA-AES128-SHA, and ECDHE-RSA-AES256-SHA

Cipher suites supported by TLS security policies

Security policy tls_cipher_policy_1_0 tls_cipher_policy_1_1 tls_cipher_policy_1_2 tls_cipher_policy_1_2_strict tls_cipher_policy_1_2_strict_with_1_3
TLS 1.2, 1.1, and 1.0 1.1 and 1.2 1.2 1.2 1.2 and 1.3
CIPHER ECDHE-RSA-AES128-GCM-SHA256 √ √ √ √ √
ECDHE-RSA-AES256-GCM-SHA384 √ √ √ √ √
ECDHE-RSA-AES128-SHA256 √ √ √ √ √
ECDHE-RSA-AES256-SHA384 √ √ √ √ √
AES128-GCM-SHA256 √ √ √ - -
AES256-GCM-SHA384 √ √ √ - -
AES128-SHA256 √ √ √ - -
AES256-SHA256 √ √ √ - -
ECDHE-RSA-AES128-SHA √ √ √ √ √
ECDHE-RSA-AES256-SHA √ √ √ √ √
AES128-SHA √ √ √ - -
AES256-SHA √ √ √ - -
DES-CBC3-SHA √ √ √ - -
TLS_AES_128_GCM_SHA256 - - - - √
TLS_AES_256_GCM_SHA384 - - - - √
TLS_CHACHA20_POLY1305_SHA256 - - - - √
TLS_AES_128_CCM_SHA256 - - - - √
TLS_AES_128_CCM_8_SHA256 - - - - √
ECDHE-ECDSA-AES128-GCM-SHA256 - - - - √
ECDHE-ECDSA-AES256-GCM-SHA384 - - - - √
ECDHE-ECDSA-AES128-SHA256 - - - - √
ECDHE-ECDSA-AES256-SHA384 - - - - √
ECDHE-ECDSA-AES128-SHA - - - - √
ECDHE-ECDSA-AES256-SHA - - - - √
Note The check mark (√) in the preceding table indicates that a cipher suite is supported, while the hyphen (-) indicates that a cipher suite is not supported.