Resolution
----------

Support of SSL/TLS renegotiation varies by the load balancer type:

*   **Classic Load Balancers:** Classic Load Balancers support secure client-initiated renegotiations for inbound SSL/TLS client connections. They also support server-initiated renegotiation for the backend SSL/TLS connection.
    
    **Note:** To turn off client-initiated renegotiations for inbound SSL/TLS connections, [migrate to an Application Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/migrate-to-application-load-balancer.html) where these renegotiations aren't supported.
    
*   **Application Load Balancers:** Application Load Balancers support SSL/TLS renegotiation for target connections. They don't support client-initiated renegotiations for inbound SSL client connections.
    
    **Note**: Application Load Balancers [support client-initiated resumptions](https://repost.aws/knowledge-center/elb-ssl-tls-session-resumption-support) for inbound SSL client connections.
    
*   **Network Load Balancers:** Network Load Balancers don't support SSL/TLS renegotiation.

All load balancers support session resumption. However, only Network Load Balancers support resumption of an SSL session with a different IP address that's associated with the same load balancer.

Related Information
-------------------

[Update the SSL negotiation configuration of your Classic Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/ssl-config-update.html)

[Security policies for your Application Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/describe-ssl-policies.html)

Hello,
I would like to clarify this:
> Application Load Balancers: Application Load Balancers support SSL/TLS renegotiation for target connections. They don't support client-initiated renegotiations for incoming SSL client connections.

Does it means that an external application calling an endpoint served through ALB wont be able to renegociate TLS? (and have to do full negotiation on every new connection)

Best.

Thank you for your comment. We'll review and update the Knowledge Center article as needed.

I want to determine if my load balancer supports Secure Sockets Layer/Transport Layer Security (SSL/TLS) renegotiation.

Determine if a Load Balancer Supports SSL/TLS Renegotiation

How can I determine if my load balancer supports SSL/TLS renegotiation?

How can I determine if my load balancer supports SSL/TLS renegotiation?

Resolution

Related Information

Relevanter Inhalt