Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.
Protokol dan sandi yang didukung antara pemirsa dan CloudFront
Jika Anda memerlukan HTTPS antara pemirsa dan CloudFront distribusi Anda, Anda harus memilih kebijakan keamanan, yang menentukan pengaturan berikut:
-
SSL/TLS Protokol minimum yang digunakan CloudFront untuk berkomunikasi dengan pemirsa.
-
Cipher yang CloudFront dapat digunakan untuk mengenkripsi komunikasi dengan pemirsa.
Untuk memilih kebijakan keamanan, tentukan nilai yang berlaku untuk Kebijakan keamanan ( SSL/TLS versi minimum). Tabel berikut mencantumkan protokol dan sandi yang CloudFront dapat digunakan untuk setiap kebijakan keamanan.
Penampil harus mendukung setidaknya salah satu sandi yang didukung untuk membuat koneksi HTTPS. CloudFront CloudFront memilih sandi dalam urutan tercantum dari antara cipher yang didukung pemirsa. Lihat juga Nama cipher OpenSSL, s2n, dan RFC.
| Kebijakan keamanan | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| SSLv3 | TLSV1 | TLSv1_2016 | TLSv1.1_2016 | TLSv1.2_2018 | TLSv1.2_2019 | TLSv1.2_2021 | TLSv1.2_2025 | TLSv1.3_2025 | |
| SSL/TLS Protokol yang didukung | |||||||||
| TLSv1.3 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ |
| TLSv1.2 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | |
| TLSv1.1 | ♦ | ♦ | ♦ | ♦ | |||||
| TLSv1 | ♦ | ♦ | ♦ | ||||||
| SSLv3 | ♦ | ||||||||
| TLSv1.3 Cipher yang didukung | |||||||||
| TLS_AES_128_GCM_SHA256 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ |
| TLS_AES_256_GCM_SHA384 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ |
| TLS_CHACHA20_POLY1305_SHA256 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | |
| Cipher ECDSA yang didukung | |||||||||
| ECDHE-ECDSA-AES128-GCM-SHA256 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | |
| ECDHE-ECDSA-AES128-SHA256 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | |||
| ECDHE-ECDSA-AES128-SHA | ♦ | ♦ | ♦ | ♦ | |||||
| ECDHE-ECDSA-AES256-GCM-SHA384 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | |
| ECDHE-ECDSA-CHACHA20-POLY1305 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ||
| ECDHE-ECDSA-AES256-SHA384 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | |||
| ECDHE-ECDSA-AES256-SHA | ♦ | ♦ | ♦ | ♦ | |||||
| Cipher RSA yang didukung | |||||||||
| ECDHE-RSA-AES128-GCM-SHA256 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | |
| ECDHE-RSA-AES128-SHA256 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | |||
| ECDHE-RSA-AES128-SHA | ♦ | ♦ | ♦ | ♦ | |||||
| ECDHE-RSA-AES256-GCM-SHA384 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | |
| ECDHE-RSA-CHACHA20-POLY1305 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ||
| ECDHE-RSA-AES256-SHA384 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | |||
| ECDHE-RSA-AES256-SHA | ♦ | ♦ | ♦ | ♦ | |||||
| AES128-GCM-SHA256 | ♦ | ♦ | ♦ | ♦ | ♦ | ||||
| AES256-GCM-SHA384 | ♦ | ♦ | ♦ | ♦ | ♦ | ||||
| AES128-SHA256 | ♦ | ♦ | ♦ | ♦ | ♦ | ||||
| AES256-SHA | ♦ | ♦ | ♦ | ♦ | |||||
| AES128-SHA | ♦ | ♦ | ♦ | ♦ | |||||
| DES-CBC3-SHA | ♦ | ♦ | |||||||
| RC4-MD5 | ♦ | ||||||||
Nama cipher OpenSSL, s2n, dan RFC
OpenSSL dan s2n
CloudFront mendukung pertukaran kunci klasik dan kuantum yang aman. Untuk pertukaran kunci klasik menggunakan kurva elips, CloudFront mendukung yang berikut:
-
prime256v1 -
X25519 -
secp384r1
Untuk pertukaran kunci kuantum yang aman, CloudFront mendukung yang berikut:
-
X25519MLKEM768 -
SecP256r1MLKEM768catatan
Quantum-safe pertukaran kunci hanya didukung dengan TLS 1.3. TLS 1.2 dan versi sebelumnya tidak mendukung pertukaran kunci kuantum yang aman.
Untuk informasi selengkapnya, lihat topik berikut:
Untuk informasi selengkapnya tentang persyaratan sertifikat untuk CloudFront, lihatPersyaratan untuk menggunakan SSL/TLS sertifikat dengan CloudFront.
| Nama cipher OpenSSL dan s2n | Nama cipher RFC |
|---|---|
| TLSv1.3 Cipher yang didukung | |
| TLS_AES_128_GCM_SHA256 | TLS_AES_128_GCM_SHA256 |
| TLS_AES_256_GCM_SHA384 | TLS_AES_256_GCM_SHA384 |
| TLS_CHACHA20_POLY1305_SHA256 | TLS_CHACHA20_POLY1305_SHA256 |
| Cipher ECDSA yang didukung | |
| ECDHE-ECDSA-AES128-GCM-SHA256 | TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 |
| ECDHE-ECDSA-AES128-SHA256 | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 |
| ECDHE-ECDSA-AES128-SHA | TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA |
| ECDHE-ECDSA-AES256-GCM-SHA384 | TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 |
| ECDHE-ECDSA-CHACHA20-POLY1305 | TLS_ECDHE_ECDSA_DENGAN_CHACHA20_POLY1305_SHA256 |
| ECDHE-ECDSA-AES256-SHA384 | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 |
| ECDHE-ECDSA-AES256-SHA | TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA |
| Cipher RSA yang didukung | |
| ECDHE-RSA-AES128-GCM-SHA256 | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 |
| ECDHE-RSA-AES128-SHA256 | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 |
| ECDHE-RSA-AES128-SHA | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA |
| ECDHE-RSA-AES256-GCM-SHA384 | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 |
| ECDHE-RSA-CHACHA20-POLY1305 | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 |
| ECDHE-RSA-AES256-SHA384 | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 |
| ECDHE-RSA-AES256-SHA | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA |
| AES128-GCM-SHA256 | TLS_RSA_WITH_AES_128_GCM_SHA256 |
| AES256-GCM-SHA384 | TLS_RSA_WITH_AES_256_GCM_SHA384 |
| AES128-SHA256 | TLS_RSA_WITH_AES_128_CBC_SHA256 |
| AES256-SHA | TLS_RSA_WITH_AES_256_CBC_SHA |
| AES128-SHA | TLS_RSA_WITH_AES_128_CBC_SHA |
| DES-CBC3-SHA | TLS_RSA_WITH_3DES_EDE_CBC_SHA |
| RC4-MD5 | TLS_RSA_WITH_RC4_128_MD5 |
Skema tanda tangan yang didukung antara pemirsa dan CloudFront
CloudFront mendukung skema tanda tangan berikut untuk koneksi antara pemirsa danCloudFront.
| Kebijakan keamanan | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| Skema tanda tangan | SSLv3 | TLSV1 | TLSv1_2016 | TLSv1.1_2016 | TLSv1.2_2018 | TLSv1.2_2019 | TLSv1.2_2021 | TLSv1.2_2025 | TLSv1.3_2025 |
| TLS_SIGNATUR_SCHEME_RSA_PSS_PSS_SHA256 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ |
| TLS_SIGNATURE_SCHEME_RSA_PSS_PSS_SHA384 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ |
| TLS_SIGNATUR_SCHEME_RSA_PSS_PSS_SHA512 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ |
| TLS_SIGNATURE_SCHEME_RSA_PSS_RSAE_SHA256 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ |
| TLS_SIGNATURE_SCHEME_RSA_PSS_RSAE_SHA384 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ |
| TLS_SIGNATURE_SCHEME_RSA_PSS_RSAE_SHA512 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ |
| TLS_SIGNATURE_SCHEME_RSA_PKCS1_SHA256 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ |
| TLS_SIGNATURE_SCHEME_RSA_PKCS1_SHA384 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ |
| TLS_SIGNATURE_SCHEME_RSA_PKCS1_SHA512 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ |
| TLS_SIGNATURE_SCHEME_RSA_PKCS1_SHA224 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ||
| TLS_SIGNATURE_SCHEME_ECDSA_SHA256 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ |
| TLS_SIGNATURE_SCHEME_ECDSA_SHA384 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ |
| TLS_SIGNATURE_SCHEME_ECDSA_SHA512 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ |
| TLS_SIGNATURE_SCHEME_ECDSA_SHA224 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ||
| TLS_SIGNATURE_SCHEME_ECDSA_SECP256R1_SHA256 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ |
| TLS_SIGNATURE_SCHEME_ECDSA_SECP384R1_SHA384 | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ | ♦ |
| TLS_SIGNATURE_SCHEME_RSA_PKCS1_SHA1 | ♦ | ♦ | ♦ | ♦ | |||||
| TLS_SIGNATURE_SCHEME_ECDSA_SHA1 | ♦ | ♦ | ♦ | ♦ | |||||
