# Ensure Elastic Load Balancers have insecure SSL ciphers

- Source: https://support.icompaas.com/support/solutions/articles/62000229614-ensure-elastic-load-balancers-have-insecure-ssl-ciphers
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [General](https://support.icompaas.com/support/solutions/62000037933) › [Policy Updates](https://support.icompaas.com/support/solutions/folders/62000168784)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:**

Elastic Load Balancing (ELB) uses Secure Socket Layer (SSL) to encrypt traffic between clients and the load balancer. However, some ELBs may be using insecure SSL ciphers, which could make the connection between the client and the load balancer vulnerable to attack.

**Rationale:**

Using insecure SSL ciphers can expose your data to unauthorized access, modification, or disclosure. This could have serious consequences, such as financial loss, identity theft, or reputational damage.

**Impact:**

If an attacker is able to exploit an insecure SSL cipher, they could gain access to your data, such as credit card numbers, passwords, or other sensitive information. They could also use this access to modify or delete your data, or to disrupt your applications.

**Default Value:**

AWS recommends that you use the ELBSecurityPolicy-TLS-1-2-2017-01 security policy. This policy includes the most secure SSL ciphers available, and it is compatible with most clients.

**Pre-Requisite:**

To follow this policy, you will need to have access to the AWS Management Console or the AWS CLI. You will also need to know the ID of the ELB that you want to update.

**Remediation Steps:**

To remediate this issue, you can follow these steps:

1.  In the AWS Management Console, go to the **Load Balancing** page.
2.  Select the ELB that you want to update.
3.  Click the **Listeners** tab.
4.  For the HTTPS listener, click the **Cipher** column.
5.  Click **Change**.
6.  In the **Select a Cipher** panel, select the **ELBSecurityPolicy-TLS-1-2-2017-01** security policy.
7.  Click **Save**.

**Test Plan:**

To test that the policy has been implemented correctly, you can use the following steps:

1.  Connect to the ELB using a client that supports the ELBSecurityPolicy-TLS-1-2-2017-01 security policy.
2.  Try to access a resource that is hosted on the ELB.
3.  If the connection is successful, then the policy has been implemented correctly.

**Implementation Plan:**

The following are the steps on how to implement this policy:

1.  Identify the ELBs that are using insecure SSL ciphers.
2.  Update the SSL ciphers on the ELBs to use the ELBSecurityPolicy-TLS-1-2-2017-01 security policy.
3.  Test that the policy has been implemented correctly.

**AWS CLI Process:**

To update the SSL ciphers on an ELB using the AWS CLI, you can use the following command:

aws elb modify-listener --listener-arn arn:aws:elasticloadbalancing:us-east-1:123456789012:listener/app/my-load-balancer/500000000/tcp/443 --ciphers ELBSecurityPolicy-TLS-1-2-2017-01

**Using AWS GUI:**

To update the SSL ciphers on an ELB using the AWS GUI, you can follow these steps:

1.  Go to the AWS Management Console.
2.  Click on the **Load Balancing** service.
3.  Click on the **Load Balancers** tab.
4.  Select the ELB that you want to update.
5.  Click on the **Listeners** tab.
6.  For the HTTPS listener, click on the **Cipher** column.
7.  Click on the **Change** button.
8.  In the **Select a Cipher** panel, select the **ELBSecurityPolicy-TLS-1-2-2017-01** security policy.
9.  Click on the **Save** button.

**Backout Plan:**

To revoke the changes that you made to the SSL ciphers on the ELB, you can follow these steps:

1.  In the AWS Management Console, go to the **Load Balancing** page.
2.  Select the ELB that you want to update.
3.  Click the **Listeners** tab.
4.  For the HTTPS listener, click the **Cipher** column.
5.  Click **Change**.
6.  In the **Select a Cipher** panel, select the **ELBSecurityPolicy-2016-08** security policy.
7.  Click **Save**.

**Note:**

-   This policy includes some insecure SSL ciphers, so it is not as secure as the ELBSecurityPolicy-TLS-1-2-2017-01 security policy.
-   You should only use this policy as a temporary measure if you need to revoke the changes that you made to the SSL ciphers on the ELB.

**Reference:**

-   AWS documentation on Elastic Load Balancing security policies: https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-security-policy-table.html

**Section 2:**

-   Tags: security, ssl, ciphers, ELB
-   Keywords: insecure, remediation, backout, policy

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.