Description

Ensure the zone's Minimum TLS Version is set to TLS 1.2 or higher, so that Cloudflare rejects HTTPS connections from clients that only support the outdated TLS 1.0 and 1.1 protocols.

Rationale

TLS 1.0 and 1.1 have known weaknesses and are deprecated by browsers and standards bodies such as PCI DSS. Allowing them lets attackers try downgrade attacks and exposes data to weaker encryption. Requiring TLS 1.2 or higher ensures all visitors use modern, secure protocols.

Impact

  • Blocks outdated and insecure TLS versions

  • Supports compliance requirements such as PCI DSS

  • Very old clients that only support TLS 1.0 or 1.1 will not connect

Default Value

By default, the Minimum TLS Version is TLS 1.0.

Pre-Requisites

  • Cloudflare account with Administrator or Super Administrator role for the zone

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to SSL/TLS > Edge Certificates.

  4. Check the Minimum TLS Version setting and verify that it is TLS 1.2 (or TLS 1.3).

  5. If it is not TLS 1.2 (or TLS 1.3), follow the implementation steps.

Implementation Steps

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to SSL/TLS > Edge Certificates.

  4. Set Minimum TLS Version to TLS 1.2 (or TLS 1.3).

Backout Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to SSL/TLS > Edge Certificates.

  4. Set Minimum TLS Version back to its previous value.

Reference