Disable weak cipher suites
Cipher suites are a combination of ciphers used to negotiate security settings during the SSL/TLS handshake (and therefore separate from the SSL/TLS protocol).Refer to the sections below to understand how cipher suites work with the different Cloudflare edge certificates. For more details and reference content, refer to Cipher suites.
Cipher suites and edge certificates
While the default cipher suites provided with Universal SSL certificates are meant for a balance of security and compatibility, some of them might be considered weak by third-party testing tools, such as the Qualys SSL Labs test.
If the Universal SSL offering does not meet your business requirements, you can use Cloudflare Advanced Certificate Manager to restrict the cipher suites used in connections between Cloudflare and your visitor’s browser.
After you subscribed to Advanced Certificate Manager for your domain, you can restrict Cipher Suites at the Zone-level requests via the API. Use the Edit zone setting endpoint, specifying ciphers as the setting name in the URI path.
Setup
Assuming this is just a one-time change, you can trigger the API call using curl.
- Get/view Global API Key (or create Token) from: https://dash.cloudflare.com/profile/api-tokens
- Get Zone ID from the bottom right of Overview page for your domain in Cloudflare Dashboard.
- Decide which cipher suites you would like to allow from the list.
Here is an example value (list of cipher suites) which you can use to replace <CIPHER_SUITES> in the commands below:
["ECDHE-ECDSA-AES128-GCM-SHA256","ECDHE-ECDSA-CHACHA20-POLY1305","ECDHE-RSA-AES128-GCM-SHA256","ECDHE-RSA-CHACHA20-POLY1305","ECDHE-ECDSA-AES256-GCM-SHA384","ECDHE-RSA-AES256-GCM-SHA384"]
Run the command to make the API call with the appropriate {zone_id}, <EMAIL>, <API_KEY>, and <CIPHER_SUITES>:
curl --request PATCH \
"https://api.cloudflare.com/client/v4/zones/{zone_id}/settings/ciphers" \
--header "X-Auth-Email: <EMAIL>" \
--header "X-Auth-Key: <API_KEY>" \
--header "Content-Type: application/json" \
--data '{"value": <CIPHER_SUITES>}'
If you choose to use a token, you will not need <EMAIL> nor <API_KEY>. You would instead need <API_TOKEN> and the command will look like this:
curl --request PATCH \
"https://api.cloudflare.com/client/v4/zones/{zone_id}/settings/ciphers" \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '{"value": <CIPHER_SUITES>}'
To revert to the default cipher suites, you can send an empty array as the value, as in the following example.
--data '{"value": []}'
Refer to Managing API Tokens and Keys to learn more about API tokens and keys.