Cipher suites — Edge certificates

Cipher suites are a combination of ciphers used to negotiate security settings during the SSL/TLS handshake Open external link (and therefore separate from the SSL/TLS protocol).

Cloudflare publishes a public repository of our SSL/TLS configurations Open external link on GitHub. You can find changes in the commit history.

We no longer support RC4 cipher suites Open external link or SSLv3 Open external link .

​​ Cipher suites recommendations

If your application has specific security requirements, Cloudflare recommends using the following values when you restrict cipher suites.

​​ Supported cipher suites

​​ Custom certificates

Custom certificates uploaded to Cloudflare will be automatically grouped together into a Certificate Pack before being deployed to the global edge.

A Certificate Pack is a group of certificates that share the same set of hostnames — for example, example.com and *.example.com — but use different signature algorithms. Each pack can include up to three certificates, with one from each of the following signature algorithms: SHA-2/RSA, SHA-2/ECDSA, and SHA-1/RSA.

​​ Disable cipher suites

With Advanced Certificate Manager or within SSL for SaaS, you can restrict connections to specific cipher suites. Currently, this functionality is only available when using the API:

• Zone Open external link
• Hostname (SSL for SaaS only) Open external link

To specify certain cipher suites, include an array of applicable cipher suites used for TLS 1.2 or lower, in the value field.

To reset to the default cipher suites, send an empty array in the value field.

​​ Matching on origin (optional)

Cloudflare will present the cipher suites to your origin and your server will select whichever cipher suite it prefers.

However, if you want to ensure that your origin server supports the same cipher suites that Cloudflare supports at our edge, use the following NGINX configuration. If you are terminating TLS on your origin using a different method, refer to that application’s documentation.

ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ecdh_curve X25519:P-256:P-384;
ssl_ciphers '[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305|ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]:ECDHE+AES128:RSA+AES128:ECDHE+AES256:RSA+AES256:ECDHE+3DES:RSA+3DES';
ssl_prefer_server_ciphers on;