create API mappings error: "To map an HTTP API, change the security policy to TLS 1.0 or TLS 1.2”

Question

This week, I created a new public regional custom domain name for my API gateway with security policy SecurityPolicy_TLS13_1_2_2021_06. When I try to add API mapping for my HTTP API Gateway prod stage, I get the error “You can only map REST APIs to this custom domain name. To map an HTTP API, change the security policy to TLS 1.0 or TLS 1.2.” 
But in the security policy list, the only available security policies are TLS 1.3 (Specifically, the only security policies it's letting me choose from are TLS13_1_2_2021_06, TLS13_1_3_2025_09, TLS13_1_3_FIPS_2025_09, TLS13_1_2_PQ_2025_09, TLS13_1_2_PFS_PQ_2025_09, TLS13_1_2_FIPS_PQ_2025_09, AND TLS13_1_2_FIPS_PFS_PQ_2025_09.)

All the TLS 1.2 policies are greyed out, so how can I add my API mapping? My API gateway is definitely an HTTP API. Was there a recent change in the security policy listing in AWS console for custom domains? 
I tried working around this, as suggested by ChatGPT, by updating the security policy to TLS_1_2 using the AWS CLI, but it did not work (no error but also didn't change anything).
 
Re:Post AI claims, “TLS 1.2 is the minimum required version for most AWS services with custom domains and will continue to be supported. There are no announcements indicating TLS 1.2 deprecation. [1] [2] [3]”  
And yet, as I’ve shown, TLS 1.2 is no longer available.

Florian Turnwald · Accepted Answer

To add to Sandhya's observation regarding the console UI behavior: the reason your AWS CLI workaround failed silently is due to an API Gateway backend requirement regarding the `endpointAccessMode` parameter.

When downgrading a custom domain's security policy from any newer SecurityPolicy_* format back to the legacy TLS_1_2 policy, the API requires you to explicitly unset the endpointAccessMode. If you only pass the securityPolicy modification in your patch operations, the API silently ignores the request.
You can bypass the console UI restrictions and fix the existing domain directly by applying both patch operations simultaneously:

```

aws apigateway update-domain-name \
  --domain-name YOUR_CUSTOM_DOMAIN_NAME \
  --patch-operations '[{"op":"replace","path":"/securityPolicy","value":"TLS_1_2"},{"op":"replace","path":"/endpointAccessMode","value":""}]'

```

Once this update is applied, API Gateway will accept the HTTP API mapping.

Florian Turnwald · Answer

* HTTP API Protocol Limitation: AWS HTTP APIs do not support TLS 1.3 security policies for custom domains. They strictly require a TLS 1.0 or TLS 1.2 security policy to function.

* Immutability of TLS 1.3 Domains: Once an API Gateway custom domain name is created using a TLS 1.3 security policy, AWS does not allow it to be downgraded to TLS 1.2 or TLS 1.0. Because you initialized the domain with SecurityPolicy_TLS13_1_2_2021_06, the TLS 1.2 options are permanently greyed out for that specific resource, and the AWS CLI modification command is silently ignored.

To resolve this and successfully map your HTTP API, you must recreate the custom domain resource:

* Delete the current custom domain name from API Gateway.

* Create a new custom domain name using the exact same domain string.

* During the creation process, select a TLS 1.2 security policy (such as SecurityPolicy_TLS_1_2_2021_01) right from the start.

* Once the new domain is active, add your API mapping for the HTTP API prod stage. It will link without errors.

Official Reference
 * AWS Documentation: (Verify the documentation notes confirming that HTTP APIs only support TLS 1.0/1.2, and that downgrading a domain from TLS 1.3 is unsupported) -> https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-custom-domain-tls-version.html

Sandhya · Answer

Hi, Ken: I tried to replicate your issue in my AWS environment, with  HTTP API and custom domain.

First, I created the custom domain with the SecurityPolicy_TLS13_1_2_2021_06, I was able to created the domain successfully, but I could not add the HTTP API with this domain.
Then, I update the Security Policy with TLS1.2 and then added the HTTP API, and it worked.
Again, to cross check, I tried to update the Security Policy back to TLS13_1_2_2021_06, it gave me this error.
Currently, **the security policy can not be updated when WebSocket or HTTP APIs are associated to the domain name. TLS 1.2 is the only permitted security for this security policy for these API types.**

It's also mentioned on the provided document:                                                                                                               **API Gateway supports security policies on all APIs. However, you can only choose a security policy for REST APIs. API Gateway only supports the TLS_1_2 security policy for HTTP or WebSocket APIs.**

create API mappings error: "To map an HTTP API, change the security policy to TLS 1.0 or TLS 1.2”

Add your answer

Relevant content