Weak TLS Versions in ALB Listener

High Risk infrastructure-security
awsterraformalbapplication-load-balancertlssslencryptiontransport-securitymitm-attack

What it is

AWS Application Load Balancer (ALB) listeners configured with SSL policies that allow weak TLS versions (1.0 and 1.1) or outdated cipher suites, exposing client connections to downgrade attacks, man-in-the-middle attacks, and eavesdropping. Weak TLS protocols have known cryptographic vulnerabilities that can be exploited to intercept or decrypt data in transit.

# VULNERABLE: ALB listeners with weak SSL policies

resource "aws_lb" "application_load_balancer" {
  name               = "production-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.alb_sg.id]
  subnets            = aws_subnet.public[*].id
}

# VULNERABLE: HTTPS listener with legacy SSL policy
resource "aws_lb_listener" "https_listener" {
  load_balancer_arn = aws_lb.application_load_balancer.arn
  port              = "443"
  protocol          = "HTTPS"
  certificate_arn   = aws_acm_certificate.ssl_cert.arn
  
  # VULNERABLE: Allows TLS 1.0/1.1
  ssl_policy = "ELBSecurityPolicy-2016-08"
  
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.app_targets.arn
  }
}

# VULNERABLE: No SSL policy specified (uses default)
resource "aws_lb_listener" "default_https" {
  load_balancer_arn = aws_lb.application_load_balancer.arn
  port              = "8443"
  protocol          = "HTTPS"
  certificate_arn   = aws_acm_certificate.api_cert.arn
  
  # VULNERABLE: No ssl_policy - uses AWS default
  
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.api_targets.arn
  }
}
# SECURE: ALB listeners with modern TLS policies

resource "aws_lb" "application_load_balancer" {
  name               = "production-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.alb_sg.id]
  subnets            = aws_subnet.public[*].id
  
  drop_invalid_header_fields = true
}

# SECURE: HTTPS listener with modern SSL policy
resource "aws_lb_listener" "https_listener_secure" {
  load_balancer_arn = aws_lb.application_load_balancer.arn
  port              = "443"
  protocol          = "HTTPS"
  certificate_arn   = aws_acm_certificate.ssl_cert.arn
  
  # SECURE: Enforces TLS 1.2+ with modern ciphers
  ssl_policy = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.app_targets.arn
  }
}

# SECURE: Alternative secure policy
resource "aws_lb_listener" "api_https_secure" {
  load_balancer_arn = aws_lb.application_load_balancer.arn
  port              = "8443"
  protocol          = "HTTPS"
  certificate_arn   = aws_acm_certificate.api_cert.arn
  
  ssl_policy = "ELBSecurityPolicy-FS-1-2-Res-2020-10"
  
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.api_targets.arn
  }
}

# SECURE: HTTP to HTTPS redirect
resource "aws_lb_listener" "http_redirect" {
  load_balancer_arn = aws_lb.application_load_balancer.arn
  port              = "80"
  protocol          = "HTTP"
  
  default_action {
    type = "redirect"
    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

💡 Why This Fix Works

The vulnerable configuration uses legacy SSL policies (ELBSecurityPolicy-2016-08, ELBSecurityPolicy-TLS-1-0-2015-04) that allow weak TLS versions 1.0 and 1.1, or omits the ssl_policy entirely. The secure version uses modern policies like ELBSecurityPolicy-TLS13-1-2-2021-06 that enforce TLS 1.2+ with strong cipher suites and Forward Secrecy, and includes HTTP to HTTPS redirect.

Why it happens

Application Load Balancer HTTPS listeners using AWS default SSL policies or legacy policies that haven't been updated. Default policies may support outdated TLS versions for backwards compatibility, exposing connections to protocol downgrade attacks.

Root causes

Default or Legacy SSL Policies

Application Load Balancer HTTPS listeners using AWS default SSL policies or legacy policies that haven't been updated. Default policies may support outdated TLS versions for backwards compatibility, exposing connections to protocol downgrade attacks.

Outdated Security Policy Versions

ALB listeners configured with outdated policies like ELBSecurityPolicy-2016-08 or earlier that support TLS 1.0 and 1.1. These legacy policies contain known cryptographic vulnerabilities and weak cipher suites.

Missing SSL Policy Specification

Terraform aws_lb_listener resources for HTTPS traffic don't explicitly specify ssl_policy parameter. Without explicit configuration, ALBs use AWS default policies which may not meet current security standards.

Backward Compatibility Requirements

Organizations maintain support for legacy TLS versions (1.0/1.1) to accommodate older clients or devices. Security is compromised to maintain compatibility with outdated systems that should be upgraded or retired.

Copy-Pasted Legacy Configurations

Infrastructure code copied from older projects or examples includes outdated SSL policy configurations. These legacy patterns persist without security review or updates to modern policies.

Fixes

1

Deploy Modern SSL Policies

Configure ALB listeners with modern SSL policies like ELBSecurityPolicy-TLS13-1-2-2021-06 or ELBSecurityPolicy-TLS-1-2-Ext-2018-06 which enforce TLS 1.2+ and include only strong cipher suites with forward secrecy.

2

Explicitly Specify SSL Policy

Add ssl_policy parameter explicitly to all aws_lb_listener resources handling HTTPS/TLS traffic. Never rely on AWS defaults - always specify the exact policy to ensure consistent security posture across deployments.

3

Enforce TLS 1.2 Minimum Version

Select SSL policies that enforce TLS 1.2 or higher as the minimum protocol version. Reject any policies supporting TLS 1.0 or 1.1, which have known vulnerabilities and are deprecated by major browsers and security standards.

4

Prioritize Forward Secrecy Policies

Use AWS-recommended policies that support forward secrecy (FS) through ECDHE cipher suites. Forward secrecy ensures that past sessions remain secure even if private keys are compromised in the future.

5

Establish Policy Review Process

Implement regular reviews of ALB SSL policies as AWS releases new versions with improved security. Subscribe to AWS security bulletins and update infrastructure code when enhanced policies become available.

6

Test Client Compatibility

Before deploying TLS 1.2+ enforcement to production, test all client applications and browsers for compatibility. Identify and upgrade any legacy clients that don't support modern TLS versions.

Detect This Vulnerability in Your Code

Sourcery automatically identifies weak tls versions in alb listener and many other security issues in your codebase.

Scan Your Code for Free Explore More Vulnerabilities