CloudFront distributions should not use deprecated SSL protocols between edge locations and custom origins
Flags CloudFront distributions that use deprecated SSL protocols for HTTPS communication with custom origins.
- service
- CloudFront
- severity
- Medium
- scope
- evaluated once per account
How to fix it
Remove SSLv3 from the SSL protocol list on each custom origin; the setting belongs to each origin individually, so a distribution with several needs each one looked at. Dropping SSLv3 clears the finding, but TLSv1 and TLSv1.1 are deprecated too and still pass, so set TLSv1.2 alone where the origin supports it. Test the origin before saving: the list says what CloudFront will offer, not what the origin can answer, and offering more than it supports turns every request into a failed handshake and a 502, with no fallback.
In the console
CloudFront → Distributions → the distribution → Origins → the origin → Minimum origin SSL protocol
See which of your accounts this check is failing on.
Book a demo