Post-quantum TLS on AWS load balancers and CloudFront
Draft: not yet tested on a real AWS account. Each point marked "check" must be confirmed against AWS's current documentation before this guide is published.
Application Load Balancer
The key exchange an ALB offers comes from its security policy. AWS publishes policies that add hybrid post-quantum key exchange (check: the current policy names, which include "PQ", and which regions have them).
- In the EC2 console, open Load Balancers, choose your ALB, then the HTTPS listener.
- Edit the listener and choose a post-quantum security policy (check: name).
- Save. New connections use it straight away.
Prefer a policy that also refuses TLS 1.0 and 1.1, or your grade is capped at B.
CloudFront
(check: whether CloudFront offers hybrid post-quantum key exchange to viewers by default, and on which security policies.) If it needs a setting, it's on the distribution's viewer security policy.
Behind the edge
Neither setting covers the connection from the load balancer or CloudFront to your servers. Our scan sees only the edge, so answers about traffic behind it come from what you declare.
Then scan your domain below.