Skip to content

GCP HTTPS load balancer is configured with SSL policy having TLS version 1.1 or lower

Description

Secure Sockets Layer (SSL) policies determine what port Transport Layer Security (TLS) features clients are permitted to use when connecting to load balancers. SSL policies control the features of SSL in Google Cloud SSL proxy load balancer and external HTTP(S) load balancers. By default, HTTP(S) Load Balancing and SSL Proxy Load Balancing use a set of SSL features that provides good security and wide compatibility.

To prevent usage of insecure features, SSL policies should use one of the following three options:

  1. At least TLS 1.2 with the MODERN profile; or
  2. The RESTRICTED profile, because it effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version; or

  3. A CUSTOM profile that does not support any of the following features:

  4. TLS_RSA_WITH_AES_128_GCM_SHA256

  5. TLS_RSA_WITH_AES_256_GCM_SHA384
  6. TLS_RSA_WITH_AES_128_CBC_SHA
  7. TLS_RSA_WITH_AES_256_CBC_SHA
  8. TLS_RSA_WITH_3DES_EDE_CBC_SHA

Load balancers are used to efficiently distribute traffic across multiple servers. Both SSL proxy and HTTPS load balancers are external load balancers: they distribute traffic from the Internet to a GCP network. GCP customers can configure load balancer SSL policies with a minimum TLS version (1.0, 1.1, or 1.2) that clients can use to establish a connection, along with a profile (Compatible, Modern, Restricted, or Custom) that specifies permissible and insecure cipher suites. It is easy for customers to configure a load balancer without knowing they are permitting outdated cipher suites.

It is possible to define SSL policies to control the features of SSL that your load balancer negotiates with clients. An SSL policy can be configured to determine the minimum TLS version and SSL features that are enabled in the load balancer. We recommend you select TLS 1.2 as the minimum TLS version supported.

Fix - Runtime

GCP Console

If the TargetSSLProxy or TargetHttpsProxy does not have an SSL policy configured, create a new SSL policy. Otherwise, modify the existing insecure policy.

To change the policy using the GCP Console, follow these steps:

  1. Log in to the GCP Console at https://console.cloud.google.com.
  2. Navigate to SSL Policies.
  3. Click on the name of the insecure policy to go to its SSL policy details page.
  4. Click EDIT.
  5. Set Minimum TLS version to TLS 1.2.
  6. Set Profile to Modern or Restricted.

  7. Alternatively, if the user selects the profile Custom, make sure that the following features are disabled:

  8. TLS_RSA_WITH_AES_128_GCM_SHA256

  9. TLS_RSA_WITH_AES_256_GCM_SHA384
  10. TLS_RSA_WITH_AES_128_CBC_SHA
  11. TLS_RSA_WITH_AES_256_CBC_SHA
  12. TLS_RSA_WITH_3DES_EDE_CBC_SHA

CLI Command

  1. For each insecure SSL policy, update it to use secure cyphers:
gcloud compute ssl-policies update NAME 
[--profile COMPATIBLE|MODERN|RESTRICTED|CUSTOM] 
--min-tls-version 1.2 [--custom-features FEATURES]
  1. If the target proxy has a GCP default SSL policy, use the following command corresponding to the proxy type to update it:
gcloud compute target-ssl-proxies update TARGET_SSL_PROXY_NAME 
--ssl-policy SSL_POLICY_NAME
gcloud compute target-https-proxies update TARGET_HTTPS_POLICY_NAME 
--sslpolicy SSL_POLICY_NAME

Fix - Buildtime

Terraform

  • Resource: google_compute_ssl_policy

  • Argument: profile = MODERN

  • Resource: google_compute_ssl_policy

  • Arguments:
    profile = CUSTOM
    custom_features = []

//Option 1
resource "google_compute_ssl_policy" "modern-profile" {
  name            = "nonprod-ssl-policy"
+ profile         = "MODERN"
+ min_tls_version = "TLS_1_2"
}

//Option 2
resource "google_compute_ssl_policy" "custom-profile" {
  name            = "custom-ssl-policy"
+ profile         = "CUSTOM"
  min_tls_version = "TLS_1_2"
+ custom_features = ["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"]
}