Question

Your security team requires that a global external Application Load Balancer serving api.example.com only negotiate TLS 1.2 or higher and disable known-weak cipher suites, while still supporting a broad range of modern clients. The load balancer already has a valid Google-managed certificate attached to its target HTTPS proxy. What is the recommended way to enforce these requirements?

Accepted Answer

Create an SSL policy with profile MODERN and minimum TLS version TLS 1.2, then attach it to the target HTTPS proxy.

Answer

Replace the Google-managed certificate with a self-managed certificate that only lists TLS 1.2 cipher suites in its metadata.

Answer

Add a URL map rewrite rule that rejects requests using TLS versions below 1.2.

Answer

Configure the backend service health check to negotiate TLS 1.2 so only compliant sessions reach the backends.