Learn how to configure Cloudflare to meet PCI scan requirements and understand what mitigations Cloudflare has in place for earlier versions of TLS/SSL.
Overview
Both TLS 1.0 and TLS 1.1 are insufficient for protecting information due to known vulnerabilities. Specifically for Cloudflare customers, the primary impact of PCI is that TLS 1.0 and TLS 1.1 are insufficient to secure payment card related traffic.
PCI standards recommend using TLS 1.2. Below, you can review our list of recommended Cloudflare SSL configurations for PCI compliance.
Also see what mitigations Cloudflare implements against vulnerabilities for TLS 1.0 and 1.1.
Recommended Cloudflare SSL configurations for PCI compliance
Freeプラン、Businessプラン、Enterpriseプランのドメインについて：
- Set the Minimum TLS Version to TLS 1.2 or newer
Proプランのドメインについて：
- 専用 SSL 証明書を購入するか、Businessプランにアップグレードして、カスタム SSL 証明書をアップロードします。
- Universal SSLを無効化します。
- Set the Minimum TLS Version to TLS 1.2 or newer
Set Minimum TLS Version to 1.2
To configure your Cloudflare domain to only allow connections using TLS 1.2 or newer protocols:
1. Log in to the Cloudflare dashboard.
2. Click the appropriate Cloudflare account for the domain.
3. Ensure the proper domain is selected.
4. Cloudflare SSL/TLSアプリをクリックします。
5. TLSの最小バージョンセクションまでスクロールします。
6. TLS 1.2を選択します。
Cloudflare mitigations against known TLS vulnerabilities
There are several mitigations Cloudflare performs against known vulnerabilities for TLS versions prior to 1.2. For example, Cloudflare does not support:
- Header compression in TLS
- Header compression in SPDY 3.1
- RC4
- SSL 3.0
- Renegotiation with clients
- DHE ciphersuites
- Export-grade ciphers
Cloudflare mitigations protect against several attacks:
- CRIME
- BREACH
- POODLE
- RC4 Cryptographic Weaknesses
- SSL Renegotiation Attack
- Protocol Downgrade Attacks
- FREAK
- LogJam
- 3DES is disabled entirely for TLS 1.1 and 1.2 and Cloudflare implements mitigations for TLS 1.0
Cloudflare provides additional mitigations for:
- Heartbleed
- Lucky Thirteen
- CCS injection vulnerability
Cloudflare has patched all servers against these vulnerabilities. Also, the Cloudflare WAF has rules to mitigate several of these vulnerabilities including Heartbleed and ShellShock.
HTTP/2 and HTTP/1.1 Cleartext Detection (Paid Plans Only):
Use Cloudflare WAF rule 100015 to restrict connections to only port 80 and 443 if you aren't using other open Cloudflare ports. You can find WAF rule 100015 in the Cloudflare UI for your domain:
- Cloudflareファイアウォールアプリをクリックします。
- 管理ルールタブをクリックします。
- Cloudflare管理ルール セクションにある詳細 をクリックします。
- 検索フィールドに100015と入力し、検索をクリックします。
- ルール100015のモードをブロックに設定します。
Once enabled, the additional Cloudflare ports are still open, but no data is sent to those ports as the WAF blocks the request with an HTTP 403 response.
Return of Bleichenbacher's Oracle Threat (ROBOT)
Security scans that note the presence of ROBOT while on Cloudflare are a false positive. Cloudflare checks padding in real time and swaps to a random session key if the padding is incorrect.
Web Application Cookies Not Marked Secure
Cloudflarecfduidcookieは、セキュリティ目的で使用されているため無効化できません。cfduid cookieには、機密情報や秘匿情報は含まれず、たとえば、ユーザーが攻撃を受けているモードで、javascriptチャレンジを通過したかどうかを記録するために使われます。
Sweet32 (CVE-2016-2183)
Transport Layer Security(TLS)プロトコルのTriple DES (3DES)暗号化アルゴリズムの使用における脆弱性です。Sweet32は、現在a proof of concept（概念実証型）攻撃であり、一般的に知られている例はありません。
Cloudflareは、次の方法を用いてTLS 1.0の脆弱性を手動で軽減しています。
- attacker must collect 32GB of data from a single TLS session
- Cloudflare forces new TLS 1.0 session keys on the affected 3DES cipher well before 32GB of data is collected
Related resources
More articles on TLS, cipher, browser, and protocol support
undefined
- Cloudflare SSL暗号化、ブラウザ、プロトコルサポート - CloudflareがサポートしているTLS暗号化とプロトコルについて分かります。Cloudflare SSL証明書がサポートするブラウザはどれか、Cloudflare証明書の署名には、どの中間証明書とルート証明書が使用されるのかについてご説明します。
- Using Minimum TLS Version in Cloudflare SSL/TLS - Transport Layer Security (TLS) guarantees encrypted communications between a client and a web server via HTTPS. It replaces the now deprecated Secured Sockets Layer (SSL) protocol.