You can select a TLS security policy when you create a listener that uses SSL over TCP. Listeners that use SSL over TCP support custom and default TLS security policies.

Default TLS security policies

A TLS security policy contains TLS protocol versions and cipher suites that are available for SSL over TCP. A later TLS version offers higher security but compromises compatibility with browsers.

Security policy managementSupported TLS versionSupported cipher suite
tls_cipher_policy_1_0TLS 1.0, TLS 1.1, and TLS 1.2The cipher suite that you select must be supported by one of the TLS versions that you use. For example, if you use TLS 1.3, you must select the cipher suites that are supported by TLS 1.3.
  • TLS 1.0 and TLS 1.1 support the following cipher suites:
    • ECDHE-ECDSA-AES128-SHA
    • ECDHE-ECDSA-AES256-SHA
    • ECDHE-RSA-AES128-SHA
    • ECDHE-RSA-AES256-SHA
    • AES128-SHA
    • AES256-SHA
    • DES-CBC3-SHA
  • TLS 1.2 supports the following cipher suites:
    • ECDHE-ECDSA-AES128-SHA
    • ECDHE-ECDSA-AES256-SHA
    • ECDHE-RSA-AES128-SHA
    • ECDHE-RSA-AES256-SHA
    • AES128-SHA
    • AES256-SHA
    • DES-CBC3-SHA
    • ECDHE-ECDSA-AES128-GCM-SHA256
    • ECDHE-ECDSA-AES256-GCM-SHA384
    • ECDHE-ECDSA-AES128-SHA256
    • ECDHE-ECDSA-AES256-SHA384
    • ECDHE-RSA-AES128-GCM-SHA256
    • ECDHE-RSA-AES256-GCM-SHA384
    • ECDHE-RSA-AES128-SHA256
    • ECDHE-RSA-AES256-SHA384
    • AES128-GCM-SHA256
    • AES256-GCM-SHA384
    • AES128-SHA256
    • AES256-SHA256
  • TLS 1.3 supports the following cipher suites:
    • TLS_AES_128_GCM_SHA256
    • TLS_AES_256_GCM_SHA384
    • TLS_CHACHA20_POLY1305_SHA256
    • TLS_AES_128_CCM_SHA256
    • TLS_AES_128_CCM_8_SHA256
tls_cipher_policy_1_1TLS 1.1 and TLS 1.2
tls_cipher_policy_1_2TLSv1.2
tls_cipher_policy_1_2_strictTLSv1.2
tls_cipher_policy_1_2_strict_with_1_3TLS 1.2 and TLS 1.3

Custom policies

To create a custom TLS security policy, perform the following steps:

  1. Log on to the NLB console.
  2. In the left-side navigation pane, click Network Load Balancer (NLB) > TLS Security Policies.
  3. On the TLS Security Policies page, click Create Custom Policy on the Custom Policy tab.
  4. In the Create TLS Security Policy dialog box, set the following parameters and click Create.
    ParameterDescription
    NameEnter a name for the TLS security policy.
    Minimal VersionSelect the version of the TLS security policy that you want to create.
    • TLS 1.0 or later
    • TLS 1.1 or later
    • TLS 1.2 or later
    Enable TLS 1.3Select whether to enable TLS 1.3.
    Important To enable TLS 1.3, you must select a cipher suite that is supported by TLS 1.3. If you do not select the supported cipher suite, the system may fail to create the connection.
    Cipher SuiteSelect a cipher suite that is supported by the specified TLS version. For more information about cipher suites that are supported by each TLS version, see Default TLS security policies.

Cipher suites supported by different TLS security policies

In the following table, a check mark () indicates that the cipher suite is supported and a hyphen (-) indicates that the cipher suite is not supported.

Security policytls_cipher_policy_1_0tls_cipher_policy_1_1tls_cipher_policy_1_2tls_cipher_policy_1_2_stricttls_cipher_policy_1_2_strict_with_1_3
TLS-1.0, 1.1, and 1.21.1 and 1.21.21.21.2 and 1.3
CIPHERECDHE-RSA-AES128-GCM-SHA256
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-RSA-AES128-SHA256
ECDHE-RSA-AES256-SHA384
AES128-GCM-SHA256--
AES256-GCM-SHA384--
AES128-SHA256--
AES256-SHA256--
ECDHE-RSA-AES128-SHA
ECDHE-RSA-AES256-SHA
AES128-SHA--
AES256-SHA--
DES-CBC3-SHA--
TLS_AES_128_GCM_SHA256----
TLS_AES_256_GCM_SHA384----
TLS_CHACHA20_POLY1305_SHA256----
TLS_AES_128_CCM_SHA256----
TLS_AES_128_CCM_8_SHA256----
ECDHE-ECDSA-AES128-GCM-SHA256----
ECDHE-ECDSA-AES256-GCM-SHA384----
ECDHE-ECDSA-AES128-SHA256----
ECDHE-ECDSA-AES256-SHA384----
ECDHE-ECDSA-AES128-SHA----
ECDHE-ECDSA-AES256-SHA----