CloudFront distributions should use SNI to serve HTTPS requests
Flags CloudFront distributions that use a dedicated IP address for SSL/TLS instead of SNI, which is the recommended and more cost-efficient approach.
- service
- CloudFront
- severity
- Low
- scope
- evaluated once per account
How to fix it
Turn Legacy clients support off, so the distribution's certificate is selected during the TLS handshake by the name the viewer asked for and no dedicated IP address is held for it. Read the access logs first: clients that predate SNI, in practice Windows XP era browsers and Android 2.x, get a failed handshake rather than a warning. A distribution still on the CloudFront default certificate also fails here and cannot reach SNI on its own; its route is the alternate domain name and custom certificate CloudFront.7 asks for, and one edit clears both findings.
In the console
CloudFront → Distributions → the distribution → General → Settings → Custom SSL certificate → Legacy clients support
See which of your accounts this check is failing on.
Book a demo