Understand which TLS ciphers and protocols are supported by Cloudflare. Learn which browsers Cloudflare SSL certificates support and which intermediate and root certificates are used to sign Cloudflare certificates.

Cloudflare TLS/SSL cipher support

Since traffic encryption occurs either between website visitors and Cloudflare or between Cloudflare and your origin web server, Cloudflare distinguishes between:

• Origin web server TLS/SSL ciphers supported by Cloudflare
• Cloudflare TLS/SSL ciphers

Origin web server TLS/SSL ciphers supported by Cloudflare

Depending on the SSL option specified in the Cloudflare Crypto app, Cloudflare either connects to an origin web server over HTTP or HTTPS.

Below is the list of origin server SSL ciphers that Cloudflare supports for TLS 1.3, TLS 1.2, and earlier TLS versions when connecting to your origin web server over HTTPS:

TLS 1.2 and earlier TLS versions:

• ECDHE-ECDSA-AES128-GCM-SHA256
• ECDHE-RSA-AES128-GCM-SHA256
• ECDHE-RSA-AES128-SHA
• AES128-GCM-SHA256
• AES128-SHA
• ECDHE-RSA-AES256-SHA384
• AES256-SHA
• DES-CBC3-SHA

TLS 1.3:

Cloudflare TLS/SSL ciphers

The configuration of both the client browser and the web server determine the cipher suite used, not the SSL certificate. When a browser initiates an HTTPS connection, it sends a list of cipher suites it supports. The web server then picks the one it wants to use.

Cloudflare currently prefers to negotiate a connection using AES128. To use AES256, a client’s browser must enforce a 256 bit cipher suite. Our preference to use AES128 may change in the future.

Below is the list of SSL ciphers that Cloudflare supports for TLS 1.3 and TLS 1.2 and older for customer’s on paid plans:

For the most current details on Cloudflare’s SSL configuration, see our public repository of SSL configurations.

Cloudflare TLS/SSL protocol support

Cloudflare only uses TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3 to establish SSL connections between the visitor and Cloudflare.

TLS 1.2 became the industry standard in 2008. Both the Payment Cards Industry Security Standards Council (PCI SSC) and the National Institute of Standards and Technology (NIST) endorse TLS 1.2 for tighter security on the web.

Cloudflare TLS/SSL browser support

Cloudflare deploys additional SSL certificates for paid plans than compared to Free plans. This allows paid plans to support certain older devices. For information on what SSL protocols and ciphers your current browser supports, visit https://www.ssllabs.com/ssltest/viewMyClient.html.

Results on supported TLS versions from tools like SSL Labs are not accurate because such tools do not attempt a full TLS connection to your Cloudflare domain. To properly test supported TLS versions configured via Minimum TLS Version, attempt a request to your Cloudflare domain while specifying a TLS version.  For example, to use the curl command to test TLS 1.1 (replace www.example.com with your Cloudflare domain and hostname):

curl https://www.example.com -svo /dev/null --tlsv1.1

If the TLS version is blocked by Cloudflare, the TLS handshake does not complete and instead returns errors such as:

• tlsv1 alert protocol version, or
• stopped the pause stream

Modern browser support for domains on paid Cloudflare plans

Cloudflare SSL certificates utilize the Subject Alternative Names (SAN) extension to support multiple domains on the same SSL certificate.  Additionally, Dedicated Certificates and Universal SSL certificates use Server Name Indication (SNI) with Elliptic Curve Digital Signature Algorithm (ECDSA).  Determine if your browser supports SNI.

It is possible for Cloudflare Support to enable non-SNI support for domains on Pro, Business, or Enterprise plans for Universal, Dedicated, Custom, or Custom Hostname certificates.  SNI and ECDSA certificates work with the following modern browsers:

Desktop Browsers installed on Windows Vista or OS X 10.6 or later:

• Internet Explorer 7
• Firefox 2
• Opera 8 (with TLS 1.1 enabled)
• Google Chrome v5.0.342.0
• Safari 2.1

Mobile Browsers:

• Mobile Safari for iOS 4.0
• Android 3.0 (Honeycomb) and later
• Windows Phone 7

Modern browser support on Free Cloudflare domains

Due to fewer SSL certificates provided for Cloudflare domains on Free plans, SSL browser support for Free domains is limited to slightly newer browsers:

Minimum supported desktop browsers:

• Firefox 2
• Internet Explorer 7 on Windows Vista
• Windows Vista or OS X 10.6 with:
  • Chrome 5.0.342.0
  • Opera 14
  • Safari 4

Minimum supported mobile browsers:

• Mobile Safari on iOS 4.0
• Android 4.0 ("Ice Cream Sandwich")
• Windows Phone 7

Digicert intermediates and roots for signing Cloudflare Certificates

Click to expand the collapsed content below for details on the root and intermediate certificates used to sign the following Cloudflare certificates:

SHA-256 ECDSA Certificate Chain (Digicert)

SHA-256 RSA Certificate Chain (Digicert)

Related resources

Essential Crypto articles

• Getting started with Cloudflare SSL
• Troubleshooting Cloudflare SSL