fix(cloudfront): Set MinimumProtocolVersion and SslSupportMethod when specifying distribution certificate

packages/@aws-cdk/aws-cloudfront/README.md

@@ -76,7 +76,8 @@ When you create a distribution, CloudFront assigns a domain name for the distrib
 be retrieved from `distribution.distributionDomainName`. CloudFront distributions use a default certificate (`*.cloudfront.net`) to support HTTPS by
 default. If you want to use your own domain name, such as `www.example.com`, you must associate a certificate with your distribution that contains
 your domain name. The certificate must be present in the AWS Certificate Manager (ACM) service in the US East (N. Virginia) region; the certificate
-may either be created by ACM, or created elsewhere and imported into ACM.
+may either be created by ACM, or created elsewhere and imported into ACM. When a certificate is used, the distribution will support HTTPS connections
+from SNI only and a minimum protocol version of TLSv1.
 
 ```ts
 const myCertificate = new acm.DnsValidatedCertificate(this, 'mySiteCert', {

packages/@aws-cdk/aws-cloudfront/lib/distribution.ts

@@ -3,6 +3,7 @@ import { Construct, IResource, Lazy, Resource, Stack, Token, Duration } from '@a
 import { CfnDistribution } from './cloudfront.generated';
 import { Origin } from './origin';
 import { CacheBehavior } from './private/cache-behavior';
+import { SSLMethod, SecurityPolicyProtocol } from './web_distribution';
 
 /**
  * Interface for CloudFront distributions
@@ -157,7 +158,7 @@ export class Distribution extends Resource implements IDistribution {
       origins: Lazy.anyValue({ produce: () => this.renderOrigins() }),
       defaultCacheBehavior: this.defaultBehavior._renderBehavior(),
       cacheBehaviors: Lazy.anyValue({ produce: () => this.renderCacheBehaviors() }),
-      viewerCertificate: this.certificate ? { acmCertificateArn: this.certificate.certificateArn } : undefined,
+      viewerCertificate: this.certificate ? this.addViewerCertificate(this.certificate) : undefined,
       customErrorResponses: this.renderErrorResponses(),
       priceClass: props.priceClass ?? undefined,
     } });
@@ -221,6 +222,14 @@ export class Distribution extends Resource implements IDistribution {
     });
   }
 
+  private addViewerCertificate(certificate: acm.ICertificate): CfnDistribution.ViewerCertificateProperty {
+    return {
+      acmCertificateArn: certificate.certificateArn,
+      sslSupportMethod: SSLMethod.SNI,
+      minimumProtocolVersion: SecurityPolicyProtocol.TLS_V1,
+    };
+  }
+
 }
 
 /**

packages/@aws-cdk/aws-cloudfront/test/distribution.test.ts

@@ -217,6 +217,8 @@ describe('certificates', () => {
       DistributionConfig: {
         ViewerCertificate: {
           AcmCertificateArn: 'arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012',
+          SslSupportMethod: 'sni-only',
+          MinimumProtocolVersion: 'TLSv1',
         },
       },
     });