---
title: TLS 1.3 Handshake Internals on AWS: ALB, CloudFront, and ACM
description: A full TLS handshake on every API call adds RTTs your p99 cannot afford. This guide walks through TLS 1.3 1-RTT handshakes and resumption, ACM cert rotation, and security policies on ALB and CloudFront.
url: https://www.joinhorizon.co/blog/tls-13-handshake-internals-aws-alb-cloudfront-acm/
datePublished: 2026-06-12T00:00:00.000Z
dateModified: 2026-10-28T00:00:00.000Z
author: palaniappan-p
category: Cloud Architecture
tags: engineering-guide, security, networking, aws, cloudfront
---

# TLS 1.3 Handshake Internals on AWS: ALB, CloudFront, and ACM

> A full TLS handshake on every API call adds RTTs your p99 cannot afford. This guide walks through TLS 1.3 1-RTT handshakes and resumption, ACM cert rotation, and security policies on ALB and CloudFront.

**TLS 1.3 (June 2026)** is the default forward path on **CloudFront** and modern **ALB security policies** (`ELBSecurityPolicy-TLS13-1-2-...`). Handshake cost moved from 2-RTT (TLS 1.2) to **1-RTT** for new sessions; **0-RTT** exists in the protocol but is risky for non-idempotent APIs, and ALB does not implement it.

## Symptoms, mechanisms, and AWS controls

| Production symptom          | Mechanism                                 | AWS control                                            |
| --------------------------- | ----------------------------------------- | ------------------------------------------------------ |
| High TLS handshake latency  | TLS 1.2 requires more round trips         | ALB/CloudFront TLS 1.3 security policy                 |
| Certificate renewal outages | Manual cert rotation                      | ACM auto-renewal with DNS validation                   |
| 0-RTT replay risk           | Early data accepted before full handshake | Keep 0-RTT off mutation endpoints; ALB does not accept early data |

My recommendation: set ALB and CloudFront to TLS 1.3 policies and, wherever an edge does accept early data, restrict 0-RTT to idempotent reads. Never use it on POST/PUT without anti-replay guards.

> **Benchmark pattern (hypothetical workload):** ALB with TLS 1.3 policy ELBSecurityPolicy-TLS13-1-2-2021-06, full handshake 1-RTT (vs 2-RTT on TLS 1.2), PSK session resumption saves 45ms p50 on repeat clients; CloudFront TLS 1.3 + HTTP/3 cuts handshake to ~1 RTT on QUIC.

## Handshake flow (architect view)

1. ClientHello with key shares
2. ServerHello + encrypted extensions + cert chain (ACM)
3. Application data

**Session tickets** and resumption cut repeat handshake work, so ensure clients enable reuse. Broken middleboxes that disable tickets show up as p99 spikes after deploy.

## AWS services mapping

| Layer       | Cert source   | Knob                              |
| ----------- | ------------- | --------------------------------- |
| CloudFront  | ACM us-east-1 | Security policy, HTTP/3 + TLS 1.3 |
| ALB         | ACM regional  | `ssl_policy`, mTLS optional       |
| API Gateway | ACM / import  | Minimum TLS 1.2                   |

**ACM rotation** is automatic for DNS-validated certs, so watch CloudWatch `DaysToExpiry` only for imported certs.

## When this advice breaks

- **Legacy IoT clients** on TLS 1.0 must use an isolated endpoint with an older policy (compliance debt).
- **Mutual TLS at scale:** consider Verified Access or private CA with device provisioning.

## What to do this week

1. Audit ALB/CloudFront policies and remove TLS 1.0/1.1 unless there is a documented exception.
2. Measure `ssl_handshake_time` via CloudFront access logs or ALB target timing.
3. Enable OCSP stapling (default on CloudFront) and verify chain completeness.

## More in This Track

Part of the **Engineering Guides** library (June 2026).

- Previous: [Part 1](https://www.joinhorizon.co/blog/modern-web-transport-tcp-congestion-http2-http3-quic-aws/)
- Next: [Part 3](https://www.joinhorizon.co/blog/high-concurrency-server-io-epoll-syscalls-zero-copy-aws/)
- Browse tracks: [Engineering Guides hub](https://www.joinhorizon.co/resources/engineering-guides/)

## What this guide doesn't cover

mTLS service mesh: see the Kubernetes track service mesh guide.

## FAQ

### Should I enable TLS 1.3 0-RTT on POST APIs?
No. 0-RTT is replay-risky on non-idempotent methods. ALB does not implement 0-RTT early data at all; it offers PSK session resumption instead. Where another edge accepts early data, restrict it to idempotent GETs. Set ALB and CloudFront to TLS 1.3 policies and keep mutations on a full 1-RTT handshake.

### Do DNS-validated ACM certificates need DaysToExpiry alarms?
Automatic renewal covers DNS-validated ACM certs. Watch DaysToExpiry for imported certificates only. CloudFront certs still belong in us-east-1 ACM.

### When must I keep TLS 1.0 or 1.1?
Only for a documented legacy IoT or client exception on an isolated endpoint. That is compliance debt. Default ALB/CloudFront policies should drop 1.0/1.1 in 2026.

### Will session tickets always cut p99 after a deploy?
Broken middleboxes that disable tickets show up as handshake spikes. Measure ssl_handshake_time in CloudFront logs or ALB timing. Tickets help repeat clients; they do not fix an origin still on TLS 1.2 2-RTT.

---

*Source: https://www.joinhorizon.co/blog/tls-13-handshake-internals-aws-alb-cloudfront-acm/*