Secure Google Cloud Platform Connections and TLS 1.0

Disabling and mitigating TLS 1.0 connections

Introduction

Google Cloud Platform (GCP) supports TLS 1.0 as well as 1.1 and 1.2; it will perform the authentication handshake using the highest TLS level supported by the client browser. Some organizations consider TLS 1.0 insecure and want to ensure that other mechanisms are used to secure connections.

This article provides information on disabling and mitigating TLS 1.0 authentication to Google Cloud Platform.

Secure connection components

This document describes four core components of addressing these requirements.

  • Configure the browser to disable use of TLS 1.0.
  • Use a private network to ensure security.
  • Expose public APIs via a broker such as Apigee.
  • Proxy Google Cloud Platform services that are considered to be insecure, and configure the proxy to disable use of TLS 1.0.

The following sections describe these components in the context of API-based administrative access, and security features for other services.

API-based administrative access

Proxy APIs via a broker such as Apigee and the HTTPS/SSL load balancer.

Apigee APIs

Apigee is a full lifecycle API management platform that enables API providers to design, secure, deploy, monitor, and scale APIs. It protects data in transit with OAuth 2.0, SAML, two-way TLS, and data at rest with encryption; TLS 1.0 and 1.1 were deprecated in August for northbound traffic.

Cloud and developer APIs

Proxy these APIs with the HTTPS/SSL load balancer via VPC Private Access and select the “restricted” profile on the load balancer.

Security features for other services

Client/browser

Use a modern browser and disable TLS 1.0. Chrome Enterprise has supported the SSLVersionMin policy since Chrome 66.

Note that client/browser based enforcement has challenges, particularly in diverse browser environments, eg. for remote and SaaS users.

Network

Google Cloud Interconnect provides secure connections between your network and Google Cloud Platform; you can extend this to your remote users with mechanisms such as VPN. These mechanisms may provide a more secure connection than TLS over open, public networks.

Server

GCE and managed services such as GCS

Select the “restricted” profile on the HTTPS load balancer to enforce modern TLS.

  • Managed services such as GCS can be front-ended with the load balancer using VPC Private Access.

GKE/K8S on GCE

The Ingress controller for GKE/K8S on GCE leverages the GCP HTTPS load balancer; Ingress doesn’t support management of the SSL profiles today.

Istio uses the Envoy load balancer. Set the TLS approved certificates appropriately.

App Engine Standard and Flex

Either:

Google Cloud Endpoints

  • TLS for Cloud Endpoints is provided by the platform hosting the service, so see above according to your endpoints type and proxy, or proxy the endpoints with Apigee.

What’s next

  • The PCI Data Security Standard Compliance Architecture Guide helps you learn how to implement the Payment Card Industry Data Security Standard (PCI DSS) for your business on Google Cloud Platform (GCP). The guide provides background about the standard, explains your role in cloud-based compliance, and then gives you the guidelines to design, deploy, and configure a payment-processing app using PCI DSS. The tutorial also discusses methods for monitoring, logging, and validating your app.
  • The Google Cloud Platform: PCI Customer Responsibility Matrix can be a helpful reference as you pursue PCI DSS compliance and conduct your own PCI DSS audits.