# 3.9 Ensure No HTTPS or SSL Proxy Load Balancers Permit SSL Policies With Weak Cipher Suites (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000233013-3-9-ensure-no-https-or-ssl-proxy-load-balancers-permit-ssl-policies-with-weak-cipher-suites-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### Profile Applicability: Level 1 ### Description: SSL policies control the Transport Layer Security (TLS) features allowed for clients connecting to load balancers. To enhance security, SSL policies should: 1. Require at least TLS 1.2 with the Modern profile, or 2. Use the Restricted profile, which enforces TLS 1.2 by default, or 3. Use a Custom profile that excludes the following weak cipher suites: - TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256 - TLS\_RSA\_WITH\_AES\_256\_GCM\_SHA384 - TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA - TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA - TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA ### Rationale: Load balancers ensure efficient traffic distribution across servers. If configured insecurely, they may permit outdated protocols or weak cipher suites, exposing applications to risks such as: - Man-in-the-middle attacks - Data interception - Traffic hijacking Ensuring strong SSL policies mitigates these risks and strengthens the security posture of the application. ### Impact: Secure SSL policies may prevent connections from clients using outdated or insecure TLS versions and cipher suites. ### Default Value: By default, GCP load balancers use the least secure SSL policy with: ### Audit Steps: #### From Google Cloud Console: 1. Visit the [Load Balancers page](https://console.cloud.google.com/netservices/loadbalancing/loadBalancers/list).               ![](https://support.icompaas.com/assets/kb/b7812cb563f5cf6c.png) 2. For each SSL Proxy or HTTPS load balancer:                                                                                                                                                                                                                               - Click its name to open the Load Balancer Details page.                                                ![](https://support.icompaas.com/assets/kb/09e01ddf67a42563.png) - Verify that each Target Proxy in the Frontend table has an SSL policy configure.                         ![](https://support.icompaas.com/assets/kb/eb3e729ef2b1d30c.png) 3. For each SSL policy: - Ensure the policy has one of the following configurations: - Profile: Modern, and Min TLS Version: TLS 1.2. - Profile: Restricted. - Profile: Custom, without the following cipher suites: - TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256 - TLS\_RSA\_WITH\_AES\_256\_GCM\_SHA384 - TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA - TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA - TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA #### From Google Cloud CLI: List all target HTTPS and SSL proxies: gcloud compute target-https-proxies list gcloud compute target-ssl-proxies list For each target proxy, describe its configuration: gcloud compute target-https-proxies describe TARGET\_HTTPS\_PROXY\_NAME gcloud compute target-ssl-proxies describe TARGET\_SSL\_PROXY\_NAME 1. Verify that the sslPolicy field is configured: - If absent, the GCP default (insecure) SSL policy is being used. Describe the SSL policy: gcloud compute ssl-policies describe SSL\_POLICY\_NAME 2. Ensure the policy meets one of these conditions: - Profile: Modern, and Min TLS Version: TLS 1.2. - Profile: Restricted. - Profile: Custom, excluding the weak cipher suites listed above. ### Remediation Steps: #### From Google Cloud Console: 1. Navigate to the [SSL Policies page](https://console.cloud.google.com/net-security/sslpolicies).                  ![](https://support.icompaas.com/assets/kb/52bff8362bb18348.png) 2. For each insecure policy: - Click its name to view details.                        ![](https://support.icompaas.com/assets/kb/201300891d232639.png) - Click Edit.                        ![](https://support.icompaas.com/assets/kb/0f8c163047b3af98.png) - Set the following: - Minimum TLS Version: TLS 1.2. - Profile: Modern or Restricted. - If using Custom, ensure the weak cipher suites are disabled. 3. Save the changes.             ![](https://support.icompaas.com/assets/kb/f5dd10fa89d30001.png) #### From Google Cloud CLI: Update an insecure SSL policy: gcloud compute ssl-policies update NAME \\ --profile=\[COMPATIBLE|MODERN|RESTRICTED|CUSTOM\] \\ --min-tls-version=TLS\_1\_2 \\ --custom-features=FEATURES Attach the updated SSL policy to the target proxy: gcloud compute target-ssl-proxies update TARGET\_SSL\_PROXY\_NAME --ssl-policy SSL\_POLICY\_NAME gcloud compute target-https-proxies update TARGET\_HTTPS\_PROXY\_NAME --ssl-policy SSL\_POLICY\_NAME - Min TLS Version: TLS 1.0 - Profile: Compatible ### References: 1. [Using SSL Policies](https://cloud.google.com/load-balancing/docs/use-ssl-policies) 2. [NIST SP 800-52r2 Guidelines](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r2.pdf) ### CIS Controls:

Control

Description

IG 1

IG 2

IG 3

3.10 Encrypt Sensitive Data in Transit

Encrypt sensitive data during transit using secure protocols like TLS.

✅

✅


14.4 Encrypt All Sensitive Information

Ensure all sensitive data is encrypted in transit.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.