The TLS policy on a listener may be configured to accept deprecated protocol versions or weak cipher suites. Clients can then be forced into a downgraded handshake and the session decrypted or modified by an entity on the transmission path, compromising the confidentiality and integrity of the data in transit.
Weak TLS Policy Permits Protocol Downgrade
CCC.LB.TH08
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.LB.CP11 | SSL/TLS Termination | The service can decrypt SSL or TLS encrypted traffic at the load balancer rather than at the backend servers, offloading the decryption task from the backend servers. |
| CCC.LB.CP24 | Configurable TLS Policy | The service may be configured with a TLS policy that sets the minimum protocol version and the permitted cipher suites negotiated with clients. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.LB.CN17 | Enforce Minimum TLS Policy | Ensure that listeners negotiate only approved cipher suites with clients. |