Does the TLS 1.0 support on CloudFront create a vulnerability when only TLS 1.2 is enabled on the Origin side?

Question

We currently host our website on AWS with CloudFront.

CloudFront currently does not support disabling TLS 1.0 or 1.1 on the Viewer side. It only provides support for limiting access to TLS 1.2 on the Origin side.

I have also limited access to only TLS 1.2 on the ELB configured with the CloudFront distribution.

Viewer -> (HTTPS/TLS1.0/1.1/1.2) -> Cloudfront -> (HTTPS/TLS1.2) -> Origin

I'm trying to verify if this mitigates the TLS 1.0 security vulnerabilities or if we would still be exposed.

Also, I've been using the following to confirm settings.

curl -k --tlsv1.0 https://OUR-DOMAIN.com # error
curl -k --tlsv1.0 https://ELB-ID.ap-northeast-1.elb.amazonaws.com # error

curl -k --tlsv1.2 https://OUR-DOMAIN.com # success
curl -k --tlsv1.2 https://ELB-ID.ap-northeast-1.elb.amazonaws.com # success

Are we still exposed to the TLS 1.0 security vulnerabilities?

How can this be tested and validated?

Answer 1

I've disabled TLS 1.0 and 1.1 on our API and the Origin side of CloudFront.

I spoke with AWS support and it seems that there is no way to disable TLS 1.0 and 1.1 on the Viewer to CloudFront side. Support notified me that there is an open feature request but no timeline for its implementation.

This means that a Viewer will be able to establish a TLS 1.0/1.1 connection with CloudFront and then CloudFront will establish the 1.2 connection to our ELB and web servers.

The API connections from the Viewer requires TLS 1.2. We will need to add a check in the UI to notify the user if an API connection cannot be established.

While not as clean of a solution as I had hoped for it seems to have mitigated our immediate risk.