Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.

# Protokol dan sandi yang didukung antara pemirsa dan CloudFront
<a name="secure-connections-supported-viewer-protocols-ciphers"></a>

Jika Anda [memerlukan HTTPS antara pemirsa dan CloudFront distribusi Anda](DownloadDistValuesCacheBehavior.md#DownloadDistValuesViewerProtocolPolicy), Anda harus memilih [kebijakan keamanan](DownloadDistValuesGeneral.md#DownloadDistValues-security-policy), yang menentukan pengaturan berikut:
+  SSL/TLS Protokol minimum yang CloudFront digunakan untuk berkomunikasi dengan pemirsa.
+ Cipher yang CloudFront dapat digunakan untuk mengenkripsi komunikasi dengan pemirsa.

Untuk memilih kebijakan keamanan, tentukan nilai yang berlaku untuk [Kebijakan keamanan ( SSL/TLS versi minimum)](DownloadDistValuesGeneral.md#DownloadDistValues-security-policy). Tabel berikut mencantumkan protokol dan cipher yang CloudFront dapat digunakan untuk setiap kebijakan keamanan.

Penampil harus mendukung setidaknya satu dari cipher yang didukung untuk membuat koneksi HTTPS dengan. CloudFront CloudFront memilih cipher dalam urutan yang terdaftar dari antara cipher yang didukung pemirsa. Lihat juga [Nama cipher OpenSSL, s2n, dan RFC](#secure-connections-openssl-rfc-cipher-names).


<table>
<thead>
  <tr><th></th><th colspan="9">Kebijakan keamanan</th></tr>
  <tr><th></th><th>SSLv3</th><th>TLSv1</th><th>TLSv1\_2016</th><th>TLSv1.1\_2016</th><th>TLSv1.2\_2018</th><th>TLSv1.2\_2019</th><th>TLSv1.2\_2021</th><th>TLSv1.2\_2025</th><th>TLSv1.3\_2025</th></tr>
</thead>
<tbody>
  <tr><td colspan="10"> SSL/TLS Protokol yang didukung</td></tr>
  <tr><td>TLSv1.3</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLSv1.2</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td></tr>
  <tr><td>TLSv1.1</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>TLSv1</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>SSLv3</td><td>♦</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td colspan="10">Didukung TLSv1 .3 cipher</td></tr>
  <tr><td>TLS\_AES\_128\_GCM\_ SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_AES\_256\_GCM\_ SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_ \_ \_ CHACHA20 POLY1305 SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td>♦</td></tr>
  <tr><td colspan="10">Cipher ECDSA yang didukung</td></tr>
  <tr><td>ECDHE-ECDSA- -GCM- AES128 SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td></tr>
  <tr><td>ECDHE-ECDSA- - AES128 SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td></tr>
  <tr><td>ECDHE-ECDSA- -SHA AES128</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>ECDHE-ECDSA- -GCM- AES256 SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td></tr>
  <tr><td>ECDHE-ECDSA- - CHACHA20 POLY1305</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td></tr>
  <tr><td>ECDHE-ECDSA- - AES256 SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td></tr>
  <tr><td>ECDHE-ECDSA- -SHA AES256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td colspan="10">Cipher RSA yang didukung</td></tr>
  <tr><td>ECDHE-RSA- -GCM- AES128 SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td></tr>
  <tr><td>ECDHE-RSA- - AES128 SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td></tr>
  <tr><td>ECDHE-RSA- -SHA AES128</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>ECDHE-RSA- -GCM- AES256 SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td></tr>
  <tr><td>ECDHE-RSA- - CHACHA20 POLY1305</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td></tr>
  <tr><td>ECDHE-RSA- - AES256 SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td></tr>
  <tr><td>ECDHE-RSA- -SHA AES256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>AES128-GCM- SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td></tr>
  <tr><td>AES256-GCM- SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td></tr>
  <tr><td>AES128-SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td></tr>
  <tr><td>AES256-SHA</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>AES128-SHA</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>DES- CBC3 -SHA</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>RC4-MD5</td><td>♦</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr>
</tbody>
</table>


## Nama cipher OpenSSL, s2n, dan RFC
<a name="secure-connections-openssl-rfc-cipher-names"></a>

OpenSSL dan [s2n](https://github.com/awslabs/s2n) menggunakan nama lain untuk cipher selain penggunaan standar TLS ([RFC 2246](https://tools.ietf.org/html/rfc2246), [RFC 4346](https://tools.ietf.org/html/rfc4346), [RFC 5246](https://tools.ietf.org/html/rfc5246), dan [RFC 8446](https://tools.ietf.org/html/rfc8446)). Tabel berikut memetakan nama OpenSSL dan s2n ke nama RFC untuk cipher lain.

CloudFront mendukung pertukaran kunci klasik dan kuantum yang aman. Untuk pertukaran kunci klasik menggunakan kurva elips, CloudFront mendukung yang berikut:
+ `prime256v1`
+ `X25519`
+ `secp384r1`

Untuk pertukaran kunci yang aman kuantum, CloudFront mendukung yang berikut:
+ `X25519MLKEM768`
+ `SecP256r1MLKEM768`
**catatan**  
Pertukaran kunci aman kuantum hanya didukung dengan TLS 1.3. TLS 1.2 dan versi sebelumnya tidak mendukung pertukaran kunci kuantum yang aman.

  Untuk informasi selengkapnya, lihat topik berikut:
  + [Kriptografi Pasca-Kuantum](https://aws.amazon.com/security/post-quantum-cryptography/)
  + [Algoritma kriptografi dan Layanan AWS](https://docs.aws.amazon.com/prescriptive-guidance/latest/encryption-best-practices/aws-cryptography-services.html#algorithms)
  + [Pertukaran kunci hibrida di TLS 1.3](https://datatracker.ietf.org/doc/draft-ietf-tls-hybrid-design/)

Untuk informasi selengkapnya tentang persyaratan sertifikat CloudFront, lihat[Persyaratan untuk menggunakan SSL/TLS sertifikat dengan CloudFront](cnames-and-https-requirements.md).


<table>
<thead>
  <tr><th>Nama cipher OpenSSL dan s2n</th><th>Nama cipher RFC</th></tr>
</thead>
<tbody>
  <tr><td colspan="2">Didukung TLSv1 .3 cipher</td></tr>
  <tr><td>TLS\_AES\_128\_GCM\_ SHA256</td><td>TLS\_AES\_128\_GCM\_ SHA256</td></tr>
  <tr><td>TLS\_AES\_256\_GCM\_ SHA384</td><td>TLS\_AES\_256\_GCM\_ SHA384</td></tr>
  <tr><td>TLS\_ \_ \_ CHACHA20 POLY1305 SHA256</td><td>TLS\_ \_ \_ CHACHA20 POLY1305 SHA256</td></tr>
  <tr><td colspan="2">Cipher ECDSA yang didukung</td></tr>
  <tr><td>ECDHE-ECDSA- -GCM- AES128 SHA256</td><td>TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_ SHA256</td></tr>
  <tr><td>ECDHE-ECDSA- - AES128 SHA256</td><td>TLS\_ECDHE\_ECDSA\_DENGAN\_AES\_128\_CBC\_ SHA256</td></tr>
  <tr><td>ECDHE-ECDSA- -SHA AES128</td><td>TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA</td></tr>
  <tr><td>ECDHE-ECDSA- -GCM- AES256 SHA384</td><td>TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_ SHA384</td></tr>
  <tr><td>ECDHE-ECDSA- - CHACHA20 POLY1305</td><td>TLS\_ECDHE\_ECDSA\_DENGAN\_ \_ \_ CHACHA20 POLY1305 SHA256</td></tr>
  <tr><td>ECDHE-ECDSA- - AES256 SHA384</td><td>TLS\_ECDHE\_ECDSA\_DENGAN\_AES\_256\_CBC\_ SHA384</td></tr>
  <tr><td>ECDHE-ECDSA- -SHA AES256</td><td>TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA</td></tr>
  <tr><td colspan="2">Cipher RSA yang didukung</td></tr>
  <tr><td>ECDHE-RSA- -GCM- AES128 SHA256</td><td>TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_ SHA256</td></tr>
  <tr><td>ECDHE-RSA- - AES128 SHA256</td><td>TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_ SHA256 </td></tr>
  <tr><td>ECDHE-RSA- -SHA AES128</td><td>TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA</td></tr>
  <tr><td>ECDHE-RSA- -GCM- AES256 SHA384</td><td>TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_ SHA384 </td></tr>
  <tr><td>ECDHE-RSA- - CHACHA20 POLY1305</td><td>TLS\_ECDHE\_RSA\_DENGAN\_ \_ \_ CHACHA20 POLY1305 SHA256</td></tr>
  <tr><td>ECDHE-RSA- - AES256 SHA384</td><td>TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_ SHA384 </td></tr>
  <tr><td>ECDHE-RSA- -SHA AES256</td><td>TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA</td></tr>
  <tr><td>AES128-GCM- SHA256</td><td>TLS\_RSA\_WITH\_AES\_128\_GCM\_ SHA256</td></tr>
  <tr><td>AES256-GCM- SHA384</td><td>TLS\_RSA\_WITH\_AES\_256\_GCM\_ SHA384</td></tr>
  <tr><td>AES128-SHA256</td><td>TLS\_RSA\_WITH\_AES\_128\_CBC\_ SHA256</td></tr>
  <tr><td>AES256-SHA</td><td>TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA</td></tr>
  <tr><td>AES128-SHA</td><td>TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA</td></tr>
  <tr><td>DES- CBC3 -SHA </td><td>TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA </td></tr>
  <tr><td>RC4-MD5</td><td>RC4TLS\_RSA\_DENGAN\_ \_128\_ MD5</td></tr>
</tbody>
</table>


## Skema tanda tangan yang didukung antara pemirsa dan CloudFront
<a name="secure-connections-viewer-signature-schemes"></a>

CloudFront mendukung skema tanda tangan berikut untuk koneksi antara pemirsa danCloudFront.


<table>
<thead>
  <tr><th></th><th colspan="9">Kebijakan keamanan</th></tr>
  <tr><th>Skema tanda tangan</th><th>SSLv3</th><th>TLSv1</th><th>TLSv1\_2016</th><th>TLSv1.1\_2016</th><th>TLSv1.2\_2018</th><th>TLSv1.2\_2019</th><th> TLSv1.2\_2021</th><th>TLSv1.2\_2025</th><th>TLSv1.3\_2025</th></tr>
</thead>
<tbody>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_RSA\_PSS\_PSS\_ SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_RSA\_PSS\_PSS\_ SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_RSA\_PSS\_PSS\_ SHA512</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_RSA\_PSS\_RSAE\_ SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_RSA\_PSS\_RSAE\_ SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_RSA\_PSS\_RSAE\_ SHA512</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>PKCS1TLS\_SIGNATURE\_SCHEME\_RSA\_ \_ SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>PKCS1TLS\_SIGNATURE\_SCHEME\_RSA\_ \_ SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>PKCS1TLS\_SIGNATURE\_SCHEME\_RSA\_ \_ SHA512</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>PKCS1TLS\_SIGNATURE\_SCHEME\_RSA\_ \_ SHA224</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_ECDSA\_ SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_ECDSA\_ SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_ECDSA\_ SHA512</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_ECDSA\_ SHA224</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_ECDSA\_ R1\_ SECP256 SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_ECDSA\_ R1\_ SECP384 SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>PKCS1TLS\_SIGNATURE\_SCHEME\_RSA\_ \_ SHA1</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_ECDSA\_ SHA1</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
</tbody>
</table>