# Ensure Classic Load Balancer HTTPS listeners use the TLS 1.2 2017-01 policy - Source: https://support.icompaas.com/support/solutions/articles/a_1793292209221341-ensure-classic-load-balancer-https-listeners-use-the-tls-12-2017-01-policy - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every HTTPS listener of a Classic Load Balancer uses the predefined security policy ELBSecurityPolicy-TLS-1-2-2017-01. This policy allows only TLS 1.2 with strong cipher suites, so clients cannot negotiate legacy SSL or TLS versions or weak ciphers with the load balancer. **Rationale** Legacy TLS versions and weak ciphers allow protocol downgrade and man-in-the-middle attacks, in which an attacker can decrypt or modify traffic between clients and the load balancer. This can expose credentials and session data and allow injected responses. Using a security policy that enforces TLS 1.2 with modern ciphers protects the confidentiality and integrity of data in transit. **Impact** - Prevents clients from negotiating insecure SSL/TLS protocols and weak ciphers - Protects data in transit against downgrade and man-in-the-middle attacks - Old clients that do not support TLS 1.2 will no longer be able to connect **Default Value** A Classic Load Balancer HTTPS listener uses the security policy selected when the listener was created. ELBSecurityPolicy-TLS-1-2-2017-01 is applied only if it was selected explicitly. **Pre-Requisites** - IAM permissions: elasticloadbalancing:DescribeLoadBalancers, elasticloadbalancing:DescribeLoadBalancerPolicies, elasticloadbalancing:CreateLoadBalancerPolicy and elasticloadbalancing:SetLoadBalancerPoliciesOfListener - Confirmation that all clients of the load balancer support TLS 1.2 **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EC2 console and select **Load Balancers** under **Load Balancing**. 3. Select a load balancer of type **classic** and open the **Listeners** tab. 4. For each listener with protocol **HTTPS**, check that the security policy is ELBSecurityPolicy-TLS-1-2-2017-01. 5. Repeat for each Classic Load Balancer in each region in use. 6. If any HTTPS listener uses a different policy, follow the implementation steps. **CLI:** List the Classic Load Balancers in the region: aws elb describe-load-balancers --region --query "LoadBalancerDescriptions\[\].LoadBalancerName" Show the protocol, port and policies of each listener of a load balancer: aws elb describe-load-balancers --region --load-balancer-names --query "LoadBalancerDescriptions\[\].ListenerDescriptions\[\].\[Listener.Protocol,Listener.LoadBalancerPort,PolicyNames\]" A load balancer fails if any listener with protocol HTTPS does not have ELBSecurityPolicy-TLS-1-2-2017-01 in its PolicyNames. A custom policy with a different name fails even if its settings are similar. Listeners using other protocols are not evaluated. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EC2 console and select **Load Balancers** under **Load Balancing**. 3. Select the Classic Load Balancer and open the **Listeners** tab. 4. Choose **Manage listeners** (or **Edit**). 5. The console cannot give the policy the required name: selecting a predefined or custom policy in the console attaches it under a generated name (for example AWSConsole-SSLNegotiationPolicy--), and the listener is evaluated by the name of the policy attached to it, which must be exactly ELBSecurityPolicy-TLS-1-2-2017-01. Use the CLI commands below to create and attach the policy under that exact name. 6. Choose **Save changes**. 7. Repeat for each affected HTTPS listener and load balancer in each region in use. **CLI:** Create the policy on the load balancer from the predefined TLS 1.2 security policy. The policy name must be exactly ELBSecurityPolicy-TLS-1-2-2017-01, because the listener is evaluated by the name of the policy attached to it: aws elb create-load-balancer-policy --region --load-balancer-name --policy-name ELBSecurityPolicy-TLS-1-2-2017-01 --policy-type-name SSLNegotiationPolicyType --policy-attributes AttributeName=Reference-Security-Policy,AttributeValue=ELBSecurityPolicy-TLS-1-2-2017-01 Apply this policy to the HTTPS listener. This command replaces all policies currently set on that listener port: aws elb set-load-balancer-policies-of-listener --region --load-balancer-name --load-balancer-port --policy-names ELBSecurityPolicy-TLS-1-2-2017-01 **Backout Plan** Before making changes, save the current listener configuration: aws elb describe-load-balancers --region --load-balancer-names > elb-listeners-backup.json To roll back: 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EC2 console and select **Load Balancers** under **Load Balancing**. 3. Select the Classic Load Balancer, open the **Listeners** tab and choose **Manage listeners** (or **Edit**). 4. Select the security policy that the HTTPS listener used before, as recorded in the saved backup. 5. Choose **Save changes**. **CLI:** aws elb set-load-balancer-policies-of-listener --region --load-balancer-name --load-balancer-port --policy-names Note: rolling back allows insecure protocols and ciphers again. Use it only as a temporary measure for clients that cannot yet use TLS 1.2. **Reference** - [https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/ssl-config-update.html](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/ssl-config-update.html) - [https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-security-policy-table.html](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-security-policy-table.html) - [https://docs.aws.amazon.com/cli/latest/reference/elb/set-load-balancer-policies-of-listener.html](https://docs.aws.amazon.com/cli/latest/reference/elb/set-load-balancer-policies-of-listener.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.