Cipher suites — Edge certificates
Supported cipher suites by protocol
Disable cipher suites
With Advanced Certificate Manager or within SSL for SaaS, you can restrict connections to specific cipher suites. Currently, this functionality is only available when using the API:
To reset to the default cipher suites, send an empty array in the
Matching on origin (optional)
However, if you want to ensure that your origin server supports the same cipher suites that Cloudflare supports at our edge, use the following NGINX configuration. If you are terminating TLS on your origin using a different method, refer to that application’s documentation.
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;ssl_ecdh_curve X25519:P-256:P-384;ssl_ciphers '[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305|ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]:ECDHE+AES128:RSA+AES128:ECDHE+AES256:RSA+AES256:ECDHE+3DES:RSA+3DES';ssl_prefer_server_ciphers on;
- Although TLS 1.3 uses the same cipher suite space as previous versions of TLS, TLS 1.3 cipher suites are defined differently. They only specifying the symmetric ciphers and cannot be used for TLS 1.2. Similarly, TLS 1.2 and lower cipher suites cannot be used with TLS 1.3 (IETF TLS 1.3 draft 21). BoringSSL also hard-codes cipher preferences in this order for TLS 1.3.