All checks
Low
CloudFront distributions should use SNI to serve HTTPS requests
Checks that the CloudFront distribution serves HTTPS with SNI rather than a dedicated IP address in every edge location, which carries a monthly charge and only helps clients released before about 2010. As in AWS's control, a distribution on the default CloudFront certificate fails too.
- service
- CloudFront
- severity
- Low
- scope
- evaluated once per account
How to fix it
- Can break clients: Viewers that do not support SNI, which AWS dates to clients released before 2010, have the connection dropped, so check the user agents in your access logs first.
- Affects another check: On the default certificate this needs the custom certificate CloudFront.7 asks for, and that one edit clears both; CloudFront.15 then checks the Security policy.
In the console
CloudFront → Distributions → the distribution → General → Settings → Edit
- Legacy clients support
- Off, so CloudFront serves HTTPS with SNI (sni-only) instead of a dedicated IP address
See which of your accounts this check is failing on.
Book a live scan