# Ensure Minimum TLS version is set to 1.2 or higher

- Source: https://support.icompaas.com/support/solutions/articles/a_1790787221256899-ensure-minimum-tls-version-is-set-to-12-or-higher
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Cloudflare](https://support.icompaas.com/support/solutions/c_1790786902273285) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790786912003423)
- Last updated: 2026-09-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the zone's Minimum TLS Version is set to TLS 1.2 or higher, so that Cloudflare rejects HTTPS connections from clients that only support the outdated TLS 1.0 and 1.1 protocols.

**Rationale**

TLS 1.0 and 1.1 have known weaknesses and are deprecated by browsers and standards bodies such as PCI DSS. Allowing them lets attackers try downgrade attacks and exposes data to weaker encryption. Requiring TLS 1.2 or higher ensures all visitors use modern, secure protocols.

**Impact**

-   Blocks outdated and insecure TLS versions
    
-   Supports compliance requirements such as PCI DSS
    
-   Very old clients that only support TLS 1.0 or 1.1 will not connect
    

**Default Value**

By default, the Minimum TLS Version is TLS 1.0.

**Pre-Requisites**

-   Cloudflare account with Administrator or Super Administrator role for the zone
    

**Test Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to SSL/TLS > Edge Certificates.
    
4.  Check the Minimum TLS Version setting and verify that it is TLS 1.2 (or TLS 1.3).
    
5.  If it is not TLS 1.2 (or TLS 1.3), follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to SSL/TLS > Edge Certificates.
    
4.  Set Minimum TLS Version to TLS 1.2 (or TLS 1.3).
    

**Backout Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to SSL/TLS > Edge Certificates.
    
4.  Set Minimum TLS Version back to its previous value.
    

**Reference**

-   [https://developers.cloudflare.com/ssl/edge-certificates/additional-options/minimum-tls/](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/minimum-tls/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.