# Protocolos e cifras compatíveis entre visualizadores e o CloudFront
<a name="secure-connections-supported-viewer-protocols-ciphers"></a>

Ao [exigir HTTPS entre os visualizadores e a distribuição do CloudFront](DownloadDistValuesCacheBehavior.md#DownloadDistValuesViewerProtocolPolicy), escolha uma [política de segurança](DownloadDistValuesGeneral.md#DownloadDistValues-security-policy) que determine as seguintes configurações:
+ O protocolo SSL/TLS mínimo que o CloudFront usa para se comunicar com os visualizadores
+ As criptografias que o CloudFront pode usar para criptografar a comunicação com os visualizadores.

Para escolher uma política de segurança, especifique o valor aplicável para [Política de segurança (versão mínima de SSL/TLS)](DownloadDistValuesGeneral.md#DownloadDistValues-security-policy). A tabela a seguir lista os protocolos e as criptografias que o CloudFront pode usar para cada política de segurança.

Um visualizador deve ser compatível com pelo menos uma dessas criptografias compatíveis para estabelecer uma conexão HTTPS com o CloudFront. O CloudFront escolhe uma criptografia na ordem listada entre as criptografias compatíveis com o visualizador. Consulte também [Nomes de cifras OpenSSL, s2n e RFC](#secure-connections-openssl-rfc-cipher-names).


<table>
<thead>
  <tr><th></th><th colspan="9">Política de segurança</th></tr>
  <tr><th></th><th>SSLv3</th><th>TLSv1</th><th>TLSv1\_2016</th><th>TLSv1.1\_2016</th><th>TLSv1.2\_2018</th><th>TLSv1.2\_2019</th><th>TLSv1.2\_2021</th><th>TLSv1.2\_2025</th><th>TLSv1.3\_2025</th></tr>
</thead>
<tbody>
  <tr><td colspan="10">Protocolos SSL/TLS compatíveis</td></tr>
  <tr><td>TLSv1.3</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLSv1.2</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td></tr>
  <tr><td>TLSv1.1</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>TLSv1</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>SSLv3</td><td>♦</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td colspan="10">Cifras TLSv1.3 compatíveis</td></tr>
  <tr><td>TLS\_AES\_128\_GCM\_SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_AES\_256\_GCM\_SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_CHACHA20\_POLY1305\_SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td>♦</td></tr>
  <tr><td colspan="10">Cifras ECDSA compatíveis</td></tr>
  <tr><td>ECDHE-ECDSA-AES128-GCM-SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td></tr>
  <tr><td>ECDHE-ECDSA-AES128-SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td></tr>
  <tr><td>ECDHE-ECDSA-AES128-SHA</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>ECDHE-ECDSA-AES256-GCM-SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td></tr>
  <tr><td>ECDHE-ECDSA-CHACHA20-POLY1305</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td></tr>
  <tr><td>ECDHE-ECDSA-AES256-SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td></tr>
  <tr><td>ECDHE-ECDSA-AES256-SHA</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td colspan="10">Cifras RSA compatíveis</td></tr>
  <tr><td>ECDHE-RSA-AES128-GCM-SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td></tr>
  <tr><td>ECDHE-RSA-AES128-SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td></tr>
  <tr><td>ECDHE-RSA-AES128-SHA</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>ECDHE-RSA-AES256-GCM-SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td></tr>
  <tr><td>ECDHE-RSA-CHACHA20-POLY1305</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td></tr>
  <tr><td>ECDHE-RSA-AES256-SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td></tr>
  <tr><td>ECDHE-RSA-AES256-SHA</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>AES128-GCM-SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td></tr>
  <tr><td>AES256-GCM-SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td></tr>
  <tr><td>AES128-SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td></tr>
  <tr><td>AES256-SHA</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>AES128-SHA</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>DES-CBC3-SHA</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>RC4-MD5</td><td>♦</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr>
</tbody>
</table>


## Nomes de cifras OpenSSL, s2n e RFC
<a name="secure-connections-openssl-rfc-cipher-names"></a>

O OpenSSL e o [s2n](https://github.com/awslabs/s2n) usam nomes diferentes para cifras que os padrões TLS usam ([RFC 2246](https://tools.ietf.org/html/rfc2246), [RFC 4346](https://tools.ietf.org/html/rfc4346), [RFC 5246](https://tools.ietf.org/html/rfc5246) e [RFC 8446](https://tools.ietf.org/html/rfc8446)). A tabela a seguir mapeia os nomes do OpenSSL e do s2n para o nome do RFC para cada cifra.

O CloudFront permite a troca de chaves clássicas e com segurança quântica. Com relação às trocas de chaves clássicas que usam curvas elípticas, o CloudFront permite o seguinte:
+ `prime256v1`
+ `X25519`
+ `secp384r1`

Com relação às trocas de chaves com segurança quântica, o CloudFront permite o seguinte:
+ `X25519MLKEM768`
+ `SecP256r1MLKEM768`
**nota**  
Somente é possível usar trocas de chaves com segurança quântica com o TLS 1.3. No TLS 1.2 e em versões anteriores, não é possível usar trocas de chaves com segurança quântica.

  Para saber mais, consulte os seguintes tópicos:
  + [Criptografia pós-quântica](https://aws.amazon.com/security/post-quantum-cryptography/)
  + [Algoritmos de criptografia e Serviços da AWS](https://docs.aws.amazon.com/prescriptive-guidance/latest/encryption-best-practices/aws-cryptography-services.html#algorithms)
  + [Troca de chaves híbrida no TLS 1.3](https://datatracker.ietf.org/doc/draft-ietf-tls-hybrid-design/)

Para ter mais informações sobre os requisitos de certificado para o CloudFront, consulte [Requisitos para usar certificados SSL/TLS com o CloudFront](cnames-and-https-requirements.md).


<table>
<thead>
  <tr><th>Nome da cifra do OpenSSL e do s2n</th><th>Nome da criptografia RFC</th></tr>
</thead>
<tbody>
  <tr><td colspan="2">Cifras TLSv1.3 compatíveis</td></tr>
  <tr><td>TLS\_AES\_128\_GCM\_SHA256</td><td>TLS\_AES\_128\_GCM\_SHA256</td></tr>
  <tr><td>TLS\_AES\_256\_GCM\_SHA384</td><td>TLS\_AES\_256\_GCM\_SHA384</td></tr>
  <tr><td>TLS\_CHACHA20\_POLY1305\_SHA256</td><td>TLS\_CHACHA20\_POLY1305\_SHA256</td></tr>
  <tr><td colspan="2">Cifras ECDSA compatíveis</td></tr>
  <tr><td>ECDHE-ECDSA-AES128-GCM-SHA256</td><td>TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256</td></tr>
  <tr><td>ECDHE-ECDSA-AES128-SHA256</td><td>TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA256</td></tr>
  <tr><td>ECDHE-ECDSA-AES128-SHA</td><td>TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_CBC\_SHA</td></tr>
  <tr><td>ECDHE-ECDSA-AES256-GCM-SHA384</td><td>TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384</td></tr>
  <tr><td>ECDHE-ECDSA-CHACHA20-POLY1305</td><td>TLS\_ECDHE\_ECDSA\_WITH\_CHACHA20\_POLY1305\_SHA256</td></tr>
  <tr><td>ECDHE-ECDSA-AES256-SHA384</td><td>TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA384</td></tr>
  <tr><td>ECDHE-ECDSA-AES256-SHA</td><td>TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_CBC\_SHA</td></tr>
  <tr><td colspan="2">Cifras RSA compatíveis</td></tr>
  <tr><td>ECDHE-RSA-AES128-GCM-SHA256</td><td>TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256</td></tr>
  <tr><td>ECDHE-RSA-AES128-SHA256</td><td>TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256 </td></tr>
  <tr><td>ECDHE-RSA-AES128-SHA</td><td>TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA</td></tr>
  <tr><td>ECDHE-RSA-AES256-GCM-SHA384</td><td>TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384 </td></tr>
  <tr><td>ECDHE-RSA-CHACHA20-POLY1305</td><td>TLS\_ECDHE\_RSA\_WITH\_CHACHA20\_POLY1305\_SHA256</td></tr>
  <tr><td>ECDHE-RSA-AES256-SHA384</td><td>TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA384 </td></tr>
  <tr><td>ECDHE-RSA-AES256-SHA</td><td>TLS\_ECDHE\_RSA\_WITH\_AES\_256\_CBC\_SHA</td></tr>
  <tr><td>AES128-GCM-SHA256</td><td>TLS\_RSA\_WITH\_AES\_128\_GCM\_SHA256</td></tr>
  <tr><td>AES256-GCM-SHA384</td><td>TLS\_RSA\_WITH\_AES\_256\_GCM\_SHA384</td></tr>
  <tr><td>AES128-SHA256</td><td>TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA256</td></tr>
  <tr><td>AES256-SHA</td><td>TLS\_RSA\_WITH\_AES\_256\_CBC\_SHA</td></tr>
  <tr><td>AES128-SHA</td><td>TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA</td></tr>
  <tr><td>DES-CBC3-SHA </td><td>TLS\_RSA\_WITH\_3DES\_EDE\_CBC\_SHA </td></tr>
  <tr><td>RC4-MD5</td><td>TLS\_RSA\_WITH\_RC4\_128\_MD5</td></tr>
</tbody>
</table>


## Esquemas de assinatura compatíveis entre visualizadores e o CloudFront
<a name="secure-connections-viewer-signature-schemes"></a>

O CloudFront é compatível com os seguintes esquemas de assinatura para conexões entre visualizadores e o CloudFront.


<table>
<thead>
  <tr><th></th><th colspan="9">Política de segurança</th></tr>
  <tr><th>Esquemas de assinatura</th><th>SSLv3</th><th>TLSv1</th><th>TLSv1\_2016</th><th>TLSv1.1\_2016</th><th>TLSv1.2\_2018</th><th>TLSv1.2\_2019</th><th> TLSv1.2\_2021</th><th>TLSv1.2\_2025</th><th>TLSv1.3\_2025</th></tr>
</thead>
<tbody>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_RSA\_PSS\_PSS\_SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_RSA\_PSS\_SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_RSA\_PSS\_SHA512</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_RSA\_PSS\_RSAE\_SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_RSA\_PSS\_RSAE\_SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_RSA\_PSS\_RSAE\_SHA512</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_RSA\_PKCS1\_SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_RSA\_PKCS1\_SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_RSA\_PKCS1\_SHA512</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_RSA\_PKCS1\_SHA224</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_ECDSA\_SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_ECDSA\_SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_ECDSA\_SHA512</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_ECDSA\_SHA224</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_ECDSA\_SECP256R1\_SHA256</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_ECDSA\_SECP384R1\_SHA384</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_RSA\_PKCS1\_SHA1</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
  <tr><td>TLS\_SIGNATURE\_SCHEME\_ECDSA\_SHA1</td><td>♦</td><td>♦</td><td>♦</td><td>♦</td><td></td><td></td><td></td><td></td><td></td></tr>
</tbody>
</table>