Cloudflare Docs
SSL/TLS
Cloudflare Docs
SSL/TLS
Search icon (depiction of a magnifying glass)
GitHub icon
Visit SSL/TLS on GitHub
Set theme to dark (⇧+D)
  1. Products
  2. SSL/TLS
  3. Edge certificates
  4. Additional options

Additional options

Once you set up SSL/TLS on your application, you can adjust the following settings in SSL/TLS > Edge Certificates:

  • Certificate Transparency Monitoring: Certificate Transparency Monitoring sends you emails when certificates — including backup certificates — are issued for your domain. This feature is in public beta and is opt-in.
  • HTTP Strict Transport Security (HSTS): HSTS protects HTTPS web servers from downgrade attacks. These attacks redirect web browsers from an HTTPS web server to an attacker-controlled server, allowing bad actors to compromise user data and cookies.
  • Certificate Signing Requests (CSRs): Generate a Certificate Signing Request (CSR) to get a custom certificate from the Certificate Authority (CA) of your choice while maintaining control of the private key on Cloudflare. The private key associated with the CSR will be generated by Cloudflare and will never leave our network.
  • TLS 1.3: TLS 1.3 enables the latest version of the TLS protocol (when supported) for improved security and performance.
  • Minimum TLS Version: Minimum TLS Version only allows HTTPS connections from visitors that support the selected TLS protocol version or newer.
  • Automatic HTTPS Rewrites: Automatic HTTPS Rewrites prevents end users from seeing “mixed content” errors by rewriting URLs from http to https for resources or links on your web site that can be served with HTTPS.
  • Total TLS: Total TLS allows Cloudflare to issue individual certificates for every proxied hostname. These certificates will protect proxied hostnames not covered by Universal certificates.
  • Always Use HTTPS: Always Use HTTPS redirects all http requests to https for all subdomains and hosts in your application.
  • Opportunistic Encryption: Opportunistic Encryption allows browsers to access HTTP URIs over an encrypted TLS channel. It’s not a substitute for HTTPS, but provides additional security for otherwise vulnerable requests.