# Ensure CloudFront distributions are not using deprecated SSL protocols

- Source: https://support.icompaas.com/support/solutions/articles/62000223404-ensure-cloudfront-distributions-are-not-using-deprecated-ssl-protocols
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Description:**

Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content. Using insecure and deprecated SSL protocols could leave your site and origin server vulnerable to exploits.

### **Rationale:**

Changing the protocol from SSL to TLS there might be chances of less deprecated protocols, TLSv1.1 as minimum protocol version for your CloudFront distribution can improve further the security of the web applications that utilize these distributions.

  

### **Impact:**

If using deprecated SSL protocols may leave the site and origin server vulnerable to exploits.

  

### **Default Value:**

By default SSL protocol is not selected for the HTTPS protocol.

  

#### **Pre-requisite:**

1.  A Distribution and origin for the distribution with a Origin domain must exist initially
    

**Remediation:**

  

### **Test Plan:**

1.  Sign in into AWS Management Console.
    
2.  Navigate to the CloudFront Dashboard  [https://console.aws.amazon.com/cloudfront/v3/home](https://console.aws.amazon.com/cloudfront/v3/home#/distributions "https://console.aws.amazon.com/cloudfront/v3/home#/distributions").
    
3.  Click on Distributions tab in top of left navigation menu.![](https://support.icompaas.com/assets/kb/921e35cd10c26a75.png)
    
4.  Select the Distributions you want to audit![](https://support.icompaas.com/assets/kb/e1eb428126a48a4c.png)
    
5.  Click on the Origins tab in top menu.![](https://support.icompaas.com/assets/kb/f8d1ece1117c2de3.png)
    
6.  Select the Origin to examine.
    
7.  Click on the **Edit** tab from top right .
    
8.  Identify if there is SSL origin protocol for the HTTPS only protocol.![](https://support.icompaas.com/assets/kb/46ad49e179fcd3d9.png)
    
      
    
      
    
9.  The selected distribution origin is using an insecure SSL protocol for HTTPS traffic, therefore the Cloudfront CDN current configuration is vulnerable to exploits.
    
10.  Follow the implementation steps to change.
     

  

**Using AWS CLI:**

aws cloudfront get-distribution --id <id-value> --query 'Distribution.DistributionConfig.Origins.Items\[\*\].CustomOriginConfig'

  
**Implementation:**

1.  Sign in into AWS Management Console.
    
2.  Navigate to the CloudFront Dashboard  [https://console.aws.amazon.com/cloudfront/v3/home](https://console.aws.amazon.com/cloudfront/v3/home#/distributions "https://console.aws.amazon.com/cloudfront/v3/home#/distributions").
    
3.  Click on Distributions tab in top of left navigation menu.
    
4.  Select the Distributions you want to change
    
5.  Click on the Origins tab in top menu
    
6.  Select the origin want to change and click edit ![](https://support.icompaas.com/assets/kb/70eb8e05e505f389.png)
    
7.  From the Protocol section and HTTPS only section choose the TLSv1 minimum origin SSL protocol.![](https://support.icompaas.com/assets/kb/f22b0eb5bf9756ca.png)
    
8.  Click on **Save changes** button to save the changes.
    

**Using AWS CLI:**

**Save the JSON file document named distconfig-secure-origin.json** 

aws cloudfront update-distribution --id EDFDVBD6EXAMPLE --default-root-object index.html

  

**Back out Plan:**

1.  Follow the implementation steps from 1-6 and then 
    
2.  From the Protocol section and HTTPS only section choose the SSLv3 minimum origin SSL protocol.
    
3.  Click on **Save changes** button to save the changes.
    

  

### **References:**

 [![](https://support.icompaas.com/assets/kb/4a255bb916243443.png)Working with distributions - Amazon CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-working-with.html) 

[![](https://support.icompaas.com/assets/kb/ee45f02b338378b9.png)get-distribution-config — AWS CLI 1.22.80 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/cloudfront/get-distribution-config.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.