Disable DHE Cipher for ALB

Question

Hello Team,
We recently came across the case where we want our SSL and TSL to allow selected ciphers only and Disable some of DHE cipher ( TLS_DHE_RSA_WITH_AES_128_CBC_SHA and TLS_DHE_RSA_WITH_AES_256_CBC_SHA ).
in order to stop some vulnerability CVE-2002-20001, CVE-2022-40735

Please help use to how to do this, as per my understanding with ALB we dnt have option to setup custom Security policy

Thanks in advance

Answer

If you apply the recommend policy **ELBSecurityPolicy-TLS13-1-2-2021-06** then this will close your TLS Issues..
Other options are:
* TLS13-1-3-2021-06 (TLS1.3 only)
* TLS13-1-2-Res-2021-06

The names on the TLS Policy map as follows

* TLS_DHE_RSA_WITH_AES_128_CBC_SHA --> DHE-RSA-AES128-SHA
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA --> DHE-RSA-AES256-SHA

These are both disabled on the recommended policy

Disable DHE Cipher for ALB

Relevant content