TLS Policies for Inbound Web Access

Overview

Appian Cloud uses Transport Layer Security (TLS) to secure inbound web traffic.

This article outlines the different supported policies and options for enabling them.

Supported policies

Appian Cloud supports four different policies across all areas of the platform:

	TLS 1.3/1.2 permissive	TLS 1.3/1.2 strict
Environment dynamic content (commercial regions)	✓ (default)	✓
Environment dynamic content (GovCloud regions)	✓ (default)	✓
Static content delivery (commercial regions)	✓
Static content delivery (GovCloud regions)	✓
Portals	✓

TLS 1.3/1.2 permissive (default)

This policy supports TLS 1.3 with fallback to TLS 1.2. This policy supports the use of forward secrecy cipher suites for clients that support it, but can fall back to cipher suites without forward secrecy to support legacy clients.

TLS 1.3/1.2 strict

This policy supports TLS 1.3 with fallback to TLS 1.2. This policy is similar to the permissive TLS 1.3/1.2 policy, but it only allows clients to access environments using cipher suites that support forward secrecy. Additionally, this policy disables cipher suites that include the Cipher Block Chaining (CBC) block cipher.

This policy can be enabled upon customer request by creating an Appian Support case.

Supported cipher suites

The following table shows a side-by-side comparison of the cipher suites supported by each of Appian Cloud's TLS policies.

Cipher suite	TLS 1.3/1.2 permissive	TLS 1.3/1.2 strict
TLS_AES_128_GCM_SHA256	✓	✓
TLS_AES_256_GCM_SHA384	✓	✓
TLS_CHACHA20_POLY1305_SHA256*	✓	✓
ECDHE-ECDSA-AES128-GCM-SHA256	✓	✓
ECDHE-RSA-AES128-GCM-SHA256	✓	✓
ECDHE-ECDSA-AES128-SHA256	✓
ECDHE-RSA-AES128-SHA256	✓
ECDHE-ECDSA-AES256-GCM-SHA384	✓	✓
ECDHE-RSA-AES256-GCM-SHA384	✓	✓
ECDHE-ECDSA-AES256-SHA384	✓
ECDHE-RSA-AES256-SHA384	✓
AES128-GCM-SHA256	✓
AES128-SHA256	✓
AES256-GCM-SHA384	✓
AES256-SHA256	✓

Feedback