Load balancer HTTPS or SSL proxy SSL policies should not have weak cipher suites

Description

The default SSL policy for load balancers uses a minimum TLS version of 1.0 and a Compatible profile, which allows the widest range of insecure cipher suites. The TLS (Transport Layer Security) protocol secures transmission of data over the internet using standard encryption technology, and older versions may pose security risks.

Remediation Steps

Google Cloud Console

If the TargetSSLProxy or TargetHttpsProxy does not have an SSL policy configured, create a new SSL policy. Otherwise, modify the existing insecure policy.

  • Navigate to SSL policies.

  • Click on the name of the insecure policy.

  • Click EDIT.

  • Set Minimum TLS version to TLS 1.2.

  • Set Profile to Modern or Restricted.

  • Click Save.

    • Alternatively, if you select the profile Custom, make sure that the following features are disabled:

TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA

gcloud CLI

  • To update an insecure SSL policy to use secure ciphers:

    • gcloud compute ssl-policies update NAME [--profile COMPATIBLE|MODERN|RESTRICTED|CUSTOM] --min-tls-version 1.2 [--custom-features FEATURES]

  • If the target proxy has a Google Cloud default SSL policy, use the following command corresponding to the proxy type to update it:

    • gcloud compute target-ssl-proxies update TARGET_SSL_PROXY_NAME --ssl-policy SSL_POLICY_NAME

    • gcloud compute target-https-proxies update TARGET_HTTPS_POLICY_NAME --ssl-policy SSL_POLICY_NAME