Question

A security team runs a public-facing web application behind an Application Load Balancer (ALB) that terminates TLS using a certificate provisioned by AWS Certificate Manager (ACM). A PCI DSS audit requires that the application no longer negotiate TLS 1.0 or TLS 1.1 and must reject weak ciphers, while still supporting modern browsers. What is the MOST appropriate action to enforce this requirement?

Accepted Answer

Update the HTTPS listener on the ALB to use a predefined ELB security policy that only permits TLS 1.2 and above.

Answer

Reissue the ACM certificate with a stronger key algorithm so that older TLS versions are automatically disabled.

Answer

Attach an AWS WAF rule to the ALB that inspects the TLS handshake and blocks connections using TLS 1.0 or 1.1.

Answer

Enable AWS Config managed rules to detect and automatically remediate the certificate's supported protocol versions.