Reference
For more on Cloudflare SSL/TLS, refer to these articles:
- Cipher suites: Consider information about supported cipher suites, how to meet your security requirements, and how to troubleshoot compatibility and other issues.
- TLS protocols: Cloudflare supports a variety of TLS protocols, ranging from TLS 1.0 to TLS 1.3.
- Certificate and hostname priority: Learn about how Cloudflare decides which certificate (and the associated SSL/TLS settings) apply to individual hostnames.
- Certificate authorities: For publicly trusted certificates, Cloudflare partners with different certificate authorities (CAs). Refer to this page to check what CAs are used for each Cloudflare offering and for more details about the CAs features, limitations, and browser compatibility.
- Browser compatibility: Review information about browser compatibility for the different Cloudflare SSL/TLS offerings.
- Migration guides: These guides walk you through the migration processes associated with various changes in Cloudflare’s SSL/TLS infrastructure.
- Certificate pinning: Learn why Cloudflare does not support HTTP public key pinning (HPKP) and consider an alternative solution to prevent certificate misissuance.
- Certificate statuses: Certificates statuses show which stage of the issuance process each certificate is in.
- Validity periods and renewal: Review information about available validity periods for your Cloudflare SSL certificates.
- Features and plans: Review information on all Cloudflare SSL/TLS features and their availability.
- Cloudflare and CVE-2019-1559: The GOLDENDOODLE and Zombie POODLE attacks affect applications that use certain cipher suites associated with TLS 1.2.
- PCI compliance and vulnerabilities mitigation: Both TLS 1.0 and TLS 1.1 are insufficient for protecting information due to known vulnerabilities. Specifically for Cloudflare customers, the primary impact of PCI is that TLS 1.0 and TLS 1.1 are insufficient to secure payment card related traffic.