Description

Ensure TLS 1.3 is turned on for the zone, so that visitors whose browsers support it connect using the latest version of the TLS protocol, which offers stronger security and faster connections.

Rationale

TLS 1.3 removes old, weak cipher suites, always uses forward secrecy, and needs fewer round trips to set up a connection. Turning it on gives visitors the most secure and fastest encrypted connection their browsers support, while older clients can still use TLS 1.2.

Impact

  • Stronger encryption with modern cipher suites only

  • Faster connection setup for visitors

  • Older clients continue to use TLS 1.2

Default Value

By default, TLS 1.3 is turned on for new zones.

Pre-Requisites

  • Cloudflare account with Administrator or Super Administrator role for the zone

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to SSL/TLS > Edge Certificates.

  4. Check the TLS 1.3 setting and verify that it is On.

  5. If it is not On, follow the implementation steps.

Implementation Steps

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to SSL/TLS > Edge Certificates.

  4. Set TLS 1.3 to On.

Backout Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to SSL/TLS > Edge Certificates.

  4. Set TLS 1.3 back to its previous value.

Reference