We currently host our website on AWS with CloudFront.
CloudFront currently does not support disabling TLS 1.0 or 1.1 on the Viewer side. It only provides support for limiting access to TLS 1.2 on the Origin side.
I have also limited access to only TLS 1.2 on the ELB configured with the CloudFront distribution.
Viewer -> (HTTPS/TLS1.0/1.1/1.2) -> Cloudfront -> (HTTPS/TLS1.2) -> Origin
I'm trying to verify if this mitigates the TLS 1.0 security vulnerabilities or if we would still be exposed.
Also, I've been using the following to confirm settings.
curl -k --tlsv1.0 https://OUR-DOMAIN.com # error curl -k --tlsv1.0 https://ELB-ID.ap-northeast-1.elb.amazonaws.com # error curl -k --tlsv1.2 https://OUR-DOMAIN.com # success curl -k --tlsv1.2 https://ELB-ID.ap-northeast-1.elb.amazonaws.com # success
Are we still exposed to the TLS 1.0 security vulnerabilities?
How can this be tested and validated?