Control: 3.9 Ensure no HTTPS or SSL proxy load balancers permit SSL policies with weak cipher suites
Secure Sockets Layer (SSL) policies determine what port Transport Layer Security (TLS) features clients are permitted to use when connecting to load balancers. To prevent usage of insecure features, SSL policies should use (a) at least TLS 1.2 with the MODERN profile; or (b) the RESTRICTED profile, because it effectively requires clients to use TLS 1.2 regardless of the chosen minimum TLS version; or (3) a CUSTOM profile that does not support any of the following features:
Load balancers are used to efficiently distribute traffic across multiple servers. Both SSL proxy and HTTPS load balancers are external load balancers, meaning they distribute traffic from the Internet to a GCP network. GCP customers can configure load balancer SSL policies with a minimum TLS version (1.0, 1.1, or 1.2) that clients can use to establish a connection, along with a profile (Compatible, Modern, Restricted, or Custom) that specifies permissible cipher suites. To comply with users using outdated protocols, GCP load balancers can be configured to permit insecure cipher suites. In fact, the GCP default SSL policy uses a minimum TLS version of 1.0 and a Compatible profile, which allows the widest range of insecure cipher suites. As a result, it is easy for customers to configure a load balancer without even knowing that they are permitting outdated cipher suites.
If the TargetSSLProxy or TargetHttpsProxy does not have an SSL policy configured, create a new SSL policy. Otherwise, modify the existing insecure policy.
- Login to GCP to the SSL Policies
- Click on the name of the insecure policy to go to its
SSL policy detailspage.
- Check the value set in
- Click pencil icon button to edit.
- Set Minimum TLS version to TLS 1.2.
- Set Profile to
- Alternatively, if the user selects the profile Custom, make sure that the following features are disabled:
From Command Line
- For each insecure SSL policy, update it to use secure cyphers:
gcloud compute ssl-policies update NAME [--profile COMPATIBLE|MODERN|RESTRICTED|CUSTOM] --min-tls-version 1.2 [--custom-featuresFEATURES]
- If the target proxy has a GCP default SSL policy, use the following command corresponding to the proxy type to update it.
gcloud compute target-ssl-proxies update TARGET_SSL_PROXY_NAME --ssl-policy SSL_POLICY_NAMEgcloud compute target-https-proxies update TARGET_HTTPS_POLICY_NAME --sslpolicy SSL_POLICY_NAME
steampipe check gcp_compliance.control.cis_v120_3_9
This control uses a named query:compute_ssl_policy_with_no_weak_cipher