--- title: AWS Application and Network Load Balancers now support... description: AWS Application Load Balancer (ALB) and Network Load Balancer (NLB) now support TLS security policies compliant with RFC 9151, which defines the Commercial... canonical: https://daily.dev/posts/aws-application-and-network-load-balancers-now-support-rfc-9151-compliant-security-policies-oltcozmno twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: AWS Application and Network Load Balancers now support RFC 9151 compliant security policies | daily.dev og:description: AWS Application Load Balancer (ALB) and Network Load Balancer (NLB) now support TLS security policies compliant with RFC 9151, which defines the Commercial... og:url: https://daily.dev/posts/aws-application-and-network-load-balancers-now-support-rfc-9151-compliant-security-policies-oltcozmno og:image: https://api.daily.dev/og/posts/oLtCOzmNo.png og:image:alt: AWS Application and Network Load Balancers now support RFC 9151 compliant security policies og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # AWS Application and Network Load Balancers now support RFC 9151 compliant security policies **[AWS](https://daily.dev/sources/aws)** · 2 min read · 0 upvotes · 0 comments ## Summary AWS Application Load Balancer (ALB) and Network Load Balancer (NLB) now support TLS security policies compliant with RFC 9151, which defines the Commercial National Security Algorithm (CNSA) 1.0 suite requirements from the NSA. These policies cover TLS 1.2 and TLS 1.3 protocols. Broader interoperability policies are also available, enabling CNSA by default while maintaining compatibility with non-CNSA clients during transition. The feature is available across all AWS Commercial Regions, GovCloud, and China regions at no additional cost, and can be configured via the AWS Console, CLI, API, or SDK. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I enable RFC 9151 CNSA 1.0 compliant TLS on an AWS Application Load Balancer? Update an existing ALB HTTPS listener or NLB TLS listener to a RFC 9151 compliant security policy, or select one when creating a new listener through the AWS Management Console, CLI, API, or SDK. These policies implement the NSA's CNSA 1.0 suite cryptographic requirements over TLS 1.2 and TLS 1.3, and are available at no additional cost in all AWS Commercial Regions, GovCloud (US), and the China region. _daily.dev surfaces AWS security policy updates for teams rolling out CNSA-compliant TLS on load balancers._ ### Can I use CNSA 1.0 compliant TLS policies on AWS load balancers while still supporting clients that don't support CNSA yet? Yes, broader interoperability policies are supported alongside strict RFC 9151 compliant policies, letting you enforce CNSA by default on ALB and NLB while maintaining compatibility with non-CNSA clients during their transition. This minimizes service disruption for organizations migrating toward full CNSA 1.0 compliance rather than requiring an all-at-once cutover. _Teams planning a phased CNSA migration can track load balancer TLS policy changes on daily.dev._ ## Similar posts on daily.dev - [AWS Network Load Balancer now supports Listener Rules for custom traffic routing](https://daily.dev/posts/aws-network-load-balancer-now-supports-listener-rules-for-custom-traffic-routing-4cru3a3t4) · AWS · 0 upvotes · 0 comments - [AWS Load Balancer Controller Reaches GA with Kubernetes Gateway API Support](https://daily.dev/posts/aws-load-balancer-controller-reaches-ga-with-kubernetes-gateway-api-support-elzeyfvna) · InfoQ · 0 upvotes · 0 comments - [Amazon ECS adds Network Load Balancer support for Linear and Canary deployments](https://daily.dev/posts/amazon-ecs-adds-network-load-balancer-support-for-linear-and-canary-deployments-4mu5wcehx) · AWS · 2 upvotes · 0 comments - [Why application security must start at the load balancer](https://daily.dev/posts/why-application-security-must-start-at-the-load-balancer-bivznty2c) · CSO Online · 0 upvotes · 0 comments - [AWS ALBs Now Support Native URL and Host Header Rewriting](https://daily.dev/posts/aws-albs-now-support-native-url-and-host-header-rewriting-pcpzxll2q) · InfoQ · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws) [View this post on daily.dev](https://daily.dev/posts/aws-application-and-network-load-balancers-now-support-rfc-9151-compliant-security-policies-oltcozmno) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"AWS Application and Network Load Balancers now support RFC 9151 compliant security policies","url":"https://daily.dev/posts/aws-application-and-network-load-balancers-now-support-rfc-9151-compliant-security-policies-oltcozmno","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/aws-application-and-network-load-balancers-now-support-rfc-9151-compliant-security-policies-oltcozmno"},"datePublished":"2026-08-04T20:04:37.838Z","dateModified":"2026-09-13T20:19:51.946Z","description":"AWS Application Load Balancer (ALB) and Network Load Balancer (NLB) now support TLS security policies compliant with RFC 9151, which defines the Commercial...","image":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","thumbnailUrl":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","isAccessibleForFree":true,"articleSection":"AWS","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"AWS","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/aws","url":"https://daily.dev/sources/aws"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/aws-application-and-network-load-balancers-now-support-rfc-9151-compliant-security-policies-oltcozmno","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"AWS","item":"https://daily.dev/sources/aws"},{"@type":"ListItem","position":3,"name":"AWS Application and Network Load Balancers now support RFC 9151 compliant security policies"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/aws-application-and-network-load-balancers-now-support-rfc-9151-compliant-security-policies-oltcozmno#faq","mainEntity":[{"@type":"Question","name":"How do I enable RFC 9151 CNSA 1.0 compliant TLS on an AWS Application Load Balancer?","acceptedAnswer":{"@type":"Answer","text":"Update an existing ALB HTTPS listener or NLB TLS listener to a RFC 9151 compliant security policy, or select one when creating a new listener through the AWS Management Console, CLI, API, or SDK. These policies implement the NSA's CNSA 1.0 suite cryptographic requirements over TLS 1.2 and TLS 1.3, and are available at no additional cost in all AWS Commercial Regions, GovCloud (US), and the China region. daily.dev surfaces AWS security policy updates for teams rolling out CNSA-compliant TLS on load balancers."}},{"@type":"Question","name":"Can I use CNSA 1.0 compliant TLS policies on AWS load balancers while still supporting clients that don't support CNSA yet?","acceptedAnswer":{"@type":"Answer","text":"Yes, broader interoperability policies are supported alongside strict RFC 9151 compliant policies, letting you enforce CNSA by default on ALB and NLB while maintaining compatibility with non-CNSA clients during their transition. This minimizes service disruption for organizations migrating toward full CNSA 1.0 compliance rather than requiring an all-at-once cutover. Teams planning a phased CNSA migration can track load balancer TLS policy changes on daily.dev."}}]} ```