Custom Certificates

Cloudflare automatically provisions SSL certificates that are shared by multiple customer domains. Business and Enterprise customers have the option to upload a custom, dedicated SSL certificate that will be presented to end users. This allows the use of extended validation (EV) and organization validated (OV) certificates.

Modern TLS Only

PCI 3.2 compliance requires either TLS 1.2 or 1.3, as there are known vulnerabilities in all earlier versions of TLS and SSL. Cloudflare provides a “Modern TLS Only” option that forces all HTTPS traffic from your website to be served over either TLS 1.2 or 1.3.

Opportunistic Encryption

Opportunistic Encryption provides HTTP-only domains that can't upgrade to HTTPS, due to mixed content or other legacy issues, the benefits of encryption and web optimization features only available using TLS without changing a single line of code.

TLS Client Auth

Cloudflare’s Mutual Auth (TLS Client Auth) creates a secure connection between a client, like an IoT device or a mobile app, and its origin. When a client attempts to establish a connection with its origin server, Cloudflare validates the device’s certificate to check it has authorized access to the endpoint. If the device has a valid client certificate, like having the correct key to enter a building, the device is able to establish a secure connection. If the device’s certificate is missing, expired, or invalid, the connection is revoked and Cloudflare returns a 403 error.

HSTS

Supporting the HTTP Strict Transport Security (HSTS) protocol is one of the easiest ways to better secure your website, API, or mobile application. HSTS is an extension to the HTTP protocol that forces clients to use secure connections for every request to your origin server. Cloudflare provides HSTS support with the click of a button.

Automatic HTTPS Rewrites

Automatic HTTPS Rewrites safely eliminates mixed content issues while enhancing performance and security by rewriting insecure URLs dynamically from known (secure) hosts to their secure counterpart. By enforcing a secure connection, Automatic HTTPS Rewrites enables you to take advantage of the latest security standards and web optimization features only available over HTTPS.

Encrypted Server Name Indicator (SNI)

Encrypted SNI replaces the plaintext “server_name” extension used in the ClientHello message during TLS negotiation with an “encrypted_server_name.” This capability expands on TLS 1.3, increasing the privacy of users by concealing the destination hostname from intermediaries between the visitor and website.

Geo Key Manager

Geo Key Manager provides the ability to choose which Cloudflare data centers have access to private keys in order to establish HTTPS connections. Cloudflare has preconfigured options to select from either US or EU data centers as well as the highest security data centers in the Cloudflare network. Data centers without access to private keys can still terminate TLS, but they will experience a slight initial delay when contacting the nearest Cloudflare data center storing the private key.

Padding Oracles and the Decline of CBC Cipher Suites

In early 2016, we saw web client support for AEAD ciphers increase from under 50% to over 70% in only six months. Learn why cipher block chaining is no longer considered completely secure.

Logjam: the Latest TLS Vulnerability Explained

Cloudflare customers were never affected by the Logjam vulnerability, but we did create a detailed writeup explaining how it works.

Build Your Own Public Key Infrastructure

Cloudflare encrypts all traffic between its datacenters using its own internal certificate authority. We built our own open-source PKI toolkit to do it.

Roughtime Protocol Support

Helps the web be more secure by reducing TLS certificate errors using an authenticated timestamp service.