Description

Ensure Public Cloud Load Balancer listeners that serve web traffic use HTTPS, either TERMINATED_HTTPS (TLS ends at the load balancer with a certificate) or HTTPS passthrough, and that plain HTTP listeners only redirect to HTTPS.

Rationale

Plain HTTP sends passwords, cookies, and data without encryption, so they can be read or changed in transit. Using HTTPS on public listeners encrypts traffic between visitors and the load balancer and protects user data.

Impact

  • Traffic between visitors and the load balancer is encrypted

  • Protects user data and sessions

  • A valid certificate must be configured

Default Value

When creating a listener, you choose the protocol, and HTTP can be selected.

Pre-Requisites

  • Permission to manage the load balancer

  • A TLS certificate, or a Let's Encrypt certificate generated from the Control Panel

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. In the project menu, under Network, select Load Balancer and open the load balancer.

  4. Open the Listeners section and review the protocol of each listener.

  5. If a listener serving web traffic uses plain HTTP without redirecting to HTTPS, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. Open the load balancer, go to the Listeners section, and click Create Listener.

  4. Select the TERMINATED_HTTPS protocol, port 443, and the certificate, and attach the pool.

  5. Change the HTTP listener to redirect to HTTPS (with an L7 policy), or remove it.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Public Cloud and choose your project.

  3. Delete the HTTPS listener or restore the previous HTTP listener settings.

Reference