Aptible offer a few ways to configure the protocols used by your HTTP(S) Endpoints for HTTPS termination through a set of Configuration variables. These are the same variables as can be defined for TLS Endpoints. If set once on the application, they will apply to all TLS and HTTPS endpoints for that application.
SSL_PROTOCOLS_OVERRIDE: Control SSL / TLS Protocols
SSL_PROTOCOLS_OVERRIDE variable lets you customize the SSL Protocols allowed on your Endpoint.
Available protocols depend on your Endpoint platform:
- For ALB Endpoints: you can choose from these 6 combinations:
TLSv1 TLSv1.1 TLSv1.2(default)
TLSv1 TLSv1.1 TLSv1.2 PFS
TLSv1.1 TLSv1.2 PFS
PFSmodifies your Endpoint's ciphersuites to only support those that offer perfect-forward secrecy.
- For Legacy ELB endpoints: the format is that of Nginx's ssl_protocols directive. Pay very close attention to the format as a bad variable will prevent the proxies from starting.
📘 The format for ALBs and ELBs is effectively identical: the only difference is the supported protocols. This means that if you have both ELB Endpoints and ALB Endpoints on a given app, or if you're upgrading from ELB to ALB, things will work as expected as long as you use protocols supported by ALBs, which are stricter.
SSL_CIPHERS_OVERRIDE: Control ciphers
This variable is only available on Legacy ELB endpoints.
On ALB Endpoints, you normally don't need to customize the ciphers available.
This variable lets you customize the SSL Ciphers used by your Endpoint.
The format is a string accepted by Nginx for its ssl_ciphers directive.
Pay very close attention to the required format, as here again a bad variable will prevent the proxies from starting.
DISABLE_WEAK_CIPHER_SUITES: an opinionated policy for ELBs
📘 This variable is only available on Legacy ELB endpoints. On ALB Endpoints, weak ciphers are disabled by default, so that setting has no effect.
Setting this variable to
true (it has to be the exact string
true) causes your Endpoint to stop accepting traffic over the
SSLv3 protocol or using the
We strongly recommend setting this variable to
true on all ELB Endpoints nowadays. Or, better, yet, upgrade to ALB Endpoints, where that's the default.
aptible config:set --app "$APP_HANDLE" \ "SSL_PROTOCOLS_OVERRIDE=TLSv1.1 TLSv1.2"
# Note: the value to enable DISABLE_WEAK_CIPHER_SUITES is the string "true" # Setting it to e.g. "1" won't work. aptible config:set --app "$APP_HANDLE" \ DISABLE_WEAK_CIPHER_SUITES=true