All checks

Medium CloudFront · account

CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins

Checks that no custom origin on the CloudFront distribution allows SSLv3, which the IETF deprecated in 2015 as insufficiently secure. Only SSLv3 fails: TLSv1 and TLSv1.1 are deprecated too and still pass, so a pass does not mean the origin connection uses TLSv1.2.

service: CloudFront
severity: Medium
scope: evaluated once per account

How to fix it

Can break clients: Test the origin first: if it cannot meet the minimum you set, CloudFront fails to connect and every request through that origin returns 502.

In the console

CloudFront → Distributions → the distribution → Origins → the origin → Edit

Minimum origin SSL protocol: TLSv1.2 on each custom origin if it supports it, otherwise the highest protocol it does

See which of your accounts this check is failing on.

Book a live scan