All checks
Medium
CloudFront distributions should use the recommended TLS security policy
Checks that a CloudFront distribution with a custom SSL/TLS certificate uses a recommended security policy for viewer connections. The policy sets the oldest TLS version and the ciphers CloudFront accepts, and older policies allow TLS 1.0 or 1.1 or weaker ciphers.
- service
- CloudFront
- severity
- Medium
- scope
- evaluated once per account
How to fix it
- Can break clients: Viewers that cannot meet the new policy fail the TLS handshake before reaching your origin, so check the ssl-protocol and ssl-cipher fields of the access logs first.
In the console
CloudFront → Distributions → the distribution → General → Settings → Edit
- Security policy
- TLSv1.2_2021 or TLSv1.2_2025; TLSv1.3_2025 accepts TLS 1.3 only, so only if every viewer supports it
See which of your accounts this check is failing on.
Book a live scan