CloudFront Now Supports TLS 1.3 Connections to Origins! I Checked the Actual Traffic in ALB Logs
This page has been translated by machine translation. View original
On November 20, 2025, Amazon CloudFront announced support for TLS 1.3 in origin connections.
CloudFront has supported TLS 1.3 for communication with viewers (clients) since 2020.
Until now, TLS 1.2 was the maximum for communication with origin servers, but with this update, TLS 1.3 is automatically selected if the origin supports it, without any changes to the CloudFront configuration.
I had the opportunity to set up an Application Load Balancer (ALB) as the origin and check in real logs whether a TLS 1.3 handshake is actually performed with CloudFront, so I'd like to share it here.
Test Environment and Architecture
I used a setup where I access the ALB via CloudFront and check the access logs output by the ALB.
Configuration Overview
- CloudFront: Default settings (TLS 1.3 not explicitly specified)
- Origin (ALB): Applied a Security Policy that supports TLS 1.3
- Log: Output ALB access logs to S3 and check them
CloudFormation Template (Excerpt)
The key point in this verification is that no changes are made to the CloudFront settings. The following is part of the CloudFormation template I used.
CloudFront Origin settings:
Origins:
- Id: ALBOrigin
DomainName: !GetAtt ApplicationLoadBalancer.DNSName
CustomOriginConfig:
HTTPSPort: 443
OriginProtocolPolicy: https-only
OriginSSLProtocols:
- TLSv1.2
ALB Listener settings:
On the ALB side, I specified the security policy ELBSecurityPolicy-TLS13-1-2-2021-06, which supports TLS 1.3.
HTTPSListener:
Type: AWS::ElasticLoadBalancingV2::Listener
Properties:
LoadBalancerArn: !Ref ApplicationLoadBalancer
Protocol: HTTPS
Port: 443
SslPolicy: ELBSecurityPolicy-TLS13-1-2-2021-06
Certificates:
- CertificateArn: !Ref CertificateArn
DefaultActions:
- Type: fixed-response
FixedResponseConfig:
StatusCode: '200'
ContentType: 'text/plain'
MessageBody: 'TLS 1.3 Verification'
Operation Check
1. Checking the Current CloudFront Settings
For this verification, I checked the current CloudFront settings via the CLI. As described in the official documentation, the OriginSSLProtocols array does not include TLSv1.3.
$ aws cloudfront get-distribution-config \
--id E1XXXXXXXXXXXX \
--query "DistributionConfig.Origins.Items[0].CustomOriginConfig.OriginSSLProtocols"
{
"Quantity": 1,
"Items": [
"TLSv1.2"
]
}
It is possible that TLSv1.3 will become available as a configuration value as it becomes more widespread, but at the time of writing, the focus of this verification is whether TLS 1.3 is used in the negotiation even though the configuration specifies "TLS 1.2".
2. Executing the Request
I sent a request to CloudFront using the curl command.
$ curl -v https://dxxxxxxxxxxxxx.cloudfront.net
> GET / HTTP/2
> Host: dxxxxxxxxxxxxx.cloudfront.net
> ...
< HTTP/2 200
< content-type: text/plain
< content-length: 20
< ...
TLS 1.3 Verification
I confirmed that the response was returned normally. However, the curl output here (such as SSL connection using TLSv1.3) reflects the communication between "Client ⇔ CloudFront", not the protocol between "CloudFront ⇔ Origin" that we want to check this time.
3. Corroboration via ALB Access Logs
To determine whether TLS 1.3 was actually used in communication with the origin, I examined the ALB access logs output to S3. After waiting about 5 minutes for the logs to be reflected, I retrieved and analyzed them with the following commands.
# Retrieve logs
$ aws s3 sync s3://my-log-bucket-xxxxxxxx/AWSLogs/123456789012/ ./logs/
# Decompress and search for the relevant request (extract only access from CloudFront)
$ gunzip -c logs/**/*.log.gz | grep "cloudfront.net" | grep "TLS 1.3 Verification"
Output log (excerpt, formatted):
https 2025-11-29T17:05:27.234837Z app/alb-test/xxxxxxxxxxxxxxxx
192.0.2.10:12345
- -1 -1 -1 200 - 306 191
"GET https://dxxxxxxxxxxxxx.cloudfront.net:443/ HTTP/1.1"
"Amazon CloudFront"
TLS_AES_128_GCM_SHA256 TLSv1.3
The TLSv1.3 entry near the end of the log confirms as fact that a TLS 1.3 connection was established between CloudFront and the ALB. Also, TLS_AES_128_GCM_SHA256 was used as the cipher suite.
4. Comparison Test: TLS 1.2 Only
Just to be sure, I also checked the behavior in the logs when the ALB policy was changed to TLS 1.2 only (ELBSecurityPolicy-2016-08).
Log after the change:
... ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2
This shows that CloudFront appropriately downgrades the protocol and connects according to the origin's settings.
Summary
This verification confirmed the following behavior for TLS 1.3 connections between CloudFront and the origin.
- No CloudFront configuration change required: Negotiation happens automatically even without specifying TLS 1.3 in
OriginSSLProtocols. - Backward compatibility maintained: If the origin supports only TLS 1.2, the connection is automatically made with TLS 1.2.
- Visibility through logs: The actual connection protocol must be checked in the origin's (ALB/NLB) access logs, not on the CloudFront side.
The biggest benefit of this update is that security strength and performance (faster handshakes) improve with changes on the origin side alone. You can improve communication quality simply by updating the backend, without taking on the risks associated with changing CloudFront settings (such as the impact of updating a distribution).
If you are currently using an ALB (Application Load Balancer) or NLB (Network Load Balancer) as a CloudFront origin and have not yet adopted a TLS 1.3-compatible policy, please consider migrating to one.
