# Ensure TLS 1.3 is enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1790787221515976-ensure-tls-13-is-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Cloudflare](https://support.icompaas.com/support/solutions/c_1790786902273285) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790786912003423)
- Last updated: 2026-09-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure TLS 1.3 is turned on for the zone, so that visitors whose browsers support it connect using the latest version of the TLS protocol, which offers stronger security and faster connections.

**Rationale**

TLS 1.3 removes old, weak cipher suites, always uses forward secrecy, and needs fewer round trips to set up a connection. Turning it on gives visitors the most secure and fastest encrypted connection their browsers support, while older clients can still use TLS 1.2.

**Impact**

-   Stronger encryption with modern cipher suites only
    
-   Faster connection setup for visitors
    
-   Older clients continue to use TLS 1.2
    

**Default Value**

By default, TLS 1.3 is turned on for new zones.

**Pre-Requisites**

-   Cloudflare account with Administrator or Super Administrator role for the zone
    

**Test Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to SSL/TLS > Edge Certificates.
    
4.  Check the TLS 1.3 setting and verify that it is On.
    
5.  If it is not On, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to SSL/TLS > Edge Certificates.
    
4.  Set TLS 1.3 to On.
    

**Backout Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to SSL/TLS > Edge Certificates.
    
4.  Set TLS 1.3 back to its previous value.
    

**Reference**

-   [https://developers.cloudflare.com/ssl/edge-certificates/additional-options/tls-13/](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/tls-13/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.