AWS elasticloadbalancing medium security documentation change
Summary
Updated certificate management documentation with expanded procedures for console/CLI/CloudFormation, added guidance about retaining previous certificates for TLS session resumption, and included security policy configuration examples.
Security assessment
The change adds explicit guidance to retain previous certificates during updates to support TLS session resumption (critical for connection stability and preventing downgrade attacks). It also documents TLS 1.3 security policies like ELBSecurityPolicy-TLS13-1-2-2021-06, which directly impacts cryptographic security. The warning about SNI dependency provides operational security context.
Diff
diff --git a/elasticloadbalancing/latest/application/listener-update-certificates.md b/elasticloadbalancing/latest/application/listener-update-certificates.md index 297ef7cf3..27fb9b822 100644 --- a//elasticloadbalancing/latest/application/listener-update-certificates.md +++ b//elasticloadbalancing/latest/application/listener-update-certificates.md @@ -28 +28 @@ After you create an HTTPS listener, you can replace the default certificate, upd -You can replace the default certificate for your listener using the following procedure. For more information, see [SSL certificates for your Application Load Balancer](./https-listener-certificates.html). +You can replace the default certificate for your listener using the following procedure. For more information, see [Default certificate](./https-listener-certificates.html#default-certificate). @@ -30 +30,4 @@ You can replace the default certificate for your listener using the following pr -###### To replace the default certificate using the console +Console + + +###### To replace the default certificate @@ -44 +47,3 @@ You can replace the default certificate for your listener using the following pr - 7. Choose **Save as default**. + 7. (Optional) By default, we select **Add previous default certificate to listener certificate list**. We recommend that you keep this option selected, unless you currently have no listener certificates for SNI and rely on TLS session resumption. + + 8. Choose **Save as default**. @@ -49 +54,4 @@ You can replace the default certificate for your listener using the following pr -###### To replace the default certificate using the AWS CLI +AWS CLI + + +###### To replace the default certificate @@ -52,0 +61,27 @@ Use the [modify-listener](https://docs.aws.amazon.com/cli/latest/reference/elbv2 + + aws elbv2 modify-listener \ + --listener-arn listener-arn \ + --certificates CertificateArn=new-default-certificate-arn + +CloudFormation + + +###### To replace the default certificate + +Update the [AWS::ElasticLoadBalancingV2::Listener](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-listener.html). + + + Resources: + myHTTPSListener: + Type: 'AWS::ElasticLoadBalancingV2::Listener' + Properties: + LoadBalancerArn: !Ref myLoadBalancer + Protocol: HTTPS + Port: 443 + DefaultActions: + - Type: "forward" + TargetGroupArn: !Ref myTargetGroup + SslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06 + Certificates: + - CertificateArn: new-default-certificate-arn + @@ -57 +92,4 @@ You can add certificates to the certificate list for your listener using the fol -###### To add certificates to the certificate list using the console +Console + + +###### To add certificates to the certificate list @@ -67 +105,7 @@ You can add certificates to the certificate list for your listener using the fol - 5. On the **Certificates** tab, choose **Add certificate**. + 5. Choose the **Certificates** tab. + + 6. To add the default certificate to the list, choose **Add default to list**. + + 7. To add nondefault certificates to the list, do the following: + + 1. Choose **Add certificate**. @@ -69 +113 @@ You can add certificates to the certificate list for your listener using the fol - 6. To add certificates that are already managed by ACM or IAM, select the check boxes for the certificates and then choose **Include as pending below**. + 2. To add certificates that are already managed by ACM or IAM, select the check boxes for the certificates and choose **Include as pending below**. @@ -71 +115 @@ You can add certificates to the certificate list for your listener using the fol - 7. If you have a certificate that isn't managed by ACM or IAM, choose **Import certificate** , complete the form, and choose **Import**. + 3. To add a certificate that isn't managed by ACM or IAM, choose **Import certificate** , complete the form, and choose **Import**. @@ -73 +117 @@ You can add certificates to the certificate list for your listener using the fol - 8. Choose **Add pending certificates**. + 4. Choose **Add pending certificates**. @@ -78 +122,4 @@ You can add certificates to the certificate list for your listener using the fol -###### To add a certificate to the certificate list using the AWS CLI +AWS CLI + + +###### To add a certificate to the certificate list @@ -81,0 +129,26 @@ Use the [add-listener-certificates](https://docs.aws.amazon.com/cli/latest/refer + + aws elbv2 add-listener-certificates \ + --listener-arn listener-arn \ + --certificates \ + CertificateArn=certificate-arn-1 \ + CertificateArn=certificate-arn-2 \ + CertificateArn=certificate-arn-3 + +CloudFormation + + +###### To add certificates to the certificate list + +Define a resource of type [AWS::ElasticLoadBalancingV2::ListenerCertificate](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-listenercertificate.html). + + + Resources: + myCertificateList: + Type: 'AWS::ElasticLoadBalancingV2::ListenerCertificate' + Properties: + ListenerArn: !Ref myTLSListener + Certificates: + - CertificateArn: "certificate-arn-1" + - CertificateArn: "certificate-arn-2" + - CertificateArn: "certificate-arn-3" + @@ -88 +161,4 @@ To remove the default certificate for a TLS listener, see Replace the default ce -###### To remove certificates from the certificate list using the console +Console + + +###### To remove certificates from the certificate list @@ -105 +181,4 @@ To remove the default certificate for a TLS listener, see Replace the default ce -###### To remove a certificate from the certificate list using the AWS CLI +AWS CLI + + +###### To remove a certificate from the certificate list @@ -108,0 +188,5 @@ Use the [remove-listener-certificates](https://docs.aws.amazon.com/cli/latest/re + + aws elbv2 remove-listener-certificates \ + --listener-arn listener-arn \ + --certificates CertificateArn=certificate-arn + @@ -119 +203,4 @@ All secure listeners attached to an Application Load Balancer must use either FI -###### To update the security policy using the console +Console + + +###### To update the security policy @@ -129 +216 @@ All secure listeners attached to an Application Load Balancer must use either FI - 5. On the **Details** page, choose **Actions** , then **Edit listener**. + 5. On the **Security** tab, choose **Edit secure listener settings**. @@ -138 +225,4 @@ All secure listeners attached to an Application Load Balancer must use either FI -###### To update the security policy using the AWS CLI +AWS CLI + + +###### To update the security policy @@ -141,0 +232,27 @@ Use the [modify-listener](https://docs.aws.amazon.com/cli/latest/reference/elbv2 + + aws elbv2 modify-listener \ + --listener-arn listener-arn \ + --ssl-policy ELBSecurityPolicy-TLS13-1-2-Res-2021-06 + +CloudFormation + + +###### To update the security policy + +Update the [AWS::ElasticLoadBalancingV2::Listener](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-listener.html) resource with the new security policy. + + + Resources: + myHTTPSListener: + Type: 'AWS::ElasticLoadBalancingV2::Listener' + Properties: + LoadBalancerArn: !Ref myLoadBalancer + Protocol: HTTPS + Port: 443 + DefaultActions: + - Type: "forward" + TargetGroupArn: !Ref myTargetGroup + SslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06 + Certificates: + - CertificateArn: certificate-arn + @@ -156 +273 @@ Create an HTTPS listener -Mutual TLS authentication +Listener rules