Merge pull request #2396 from guardian/an/ssl-policy-only-on-https

Only set an SSL policy on HTTPS application listeners
guardian · Aug 1, 2024 · 56e2c79 · 56e2c79
2 parents 552aac7 + c7426d3
commit 56e2c79
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/.changeset/perfect-hats-allow.md b/.changeset/perfect-hats-allow.md
@@ -0,0 +1,5 @@
+---
+"@guardian/cdk": patch
+---
+
+Only set an SSL policy on HTTPS application listeners
diff --git a/src/constructs/loadbalancing/alb/application-listener.ts b/src/constructs/loadbalancing/alb/application-listener.ts
@@ -52,7 +52,7 @@ export class GuHttpsApplicationListener extends GuAppAwareConstruct(ApplicationL
     const mergedProps: GuApplicationListenerProps = {
       port: certificate ? 443 : 8080,
       protocol: certificate ? ApplicationProtocol.HTTPS : ApplicationProtocol.HTTP,
-      sslPolicy: SslPolicy.RECOMMENDED_TLS,
+      sslPolicy: certificate ? SslPolicy.RECOMMENDED_TLS : undefined,
       ...props,
       certificates: certificate
         ? [