Application and Network Load Balancer listeners should use secure protocols to encrypt data in transit

How to fix it

• Can break clients: Clients that still connect to this listener over plain HTTP or TCP fail once it requires TLS, so move them to HTTPS or TLS first.
• Affects another check: An HTTP listener that only redirects to HTTPS passes ELB.1 and fails this, so delete it if no client needs the redirect, or mark this finding Won't fix.

In the console

EC2 → Load balancers → the load balancer → Listeners and rules → the listener → Actions → Edit listener

Protocol

HTTPS on an Application Load Balancer; TLS on a Network Load Balancer

Default SSL/TLS certificate

A certificate for the listener's domain, from ACM or IAM

Security policy

ELBSecurityPolicy-TLS13-1-2-Res-2021-06, or another policy ELB.17 accepts

With the AWS CLI

aws elbv2 modify-listener --listener-arn <listener-arn> --protocol HTTPS --port 443 --certificates CertificateArn=<acm-certificate-arn> --ssl-policy ELBSecurityPolicy-TLS13-1-2-Res-2021-06 --region <region>

With Terraform

resource "aws_lb_listener" "https" {
  load_balancer_arn = var.load_balancer_arn
  port              = 443
  protocol          = "HTTPS"
  certificate_arn   = var.acm_certificate_arn
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-Res-2021-06"

  default_action {
    type             = "forward"
    target_group_arn = var.target_group_arn
  }
}