04 · Build an HTTPS and TLS 1.3 security baseline
After Full strict is stable, configure HTTPS redirects, minimum TLS, TLS 1.3, and HSTS in an order that preserves compatibility and rollback options.
Edited and verified by Orange Book Editorial Team ·
Outcome
HTTP requests redirect to HTTPS at the Cloudflare edge, modern clients can negotiate TLS 1.3, compatibility evidence determines whether older protocols are rejected, and HSTS is introduced gradually only after certificates and every covered hostname are stable.
Four settings solve four different problems
| Capability | What it does | What it does not fix | Risk |
|---|---|---|---|
| Always Use HTTPS | Redirects visitor HTTP requests to HTTPS | HTTP subresources hard-coded inside HTML | Low, but check for redirect loops |
| Minimum TLS Version | Rejects visitor connections below the selected version | TLS between Cloudflare and the origin | Medium; it removes legacy clients |
| TLS 1.3 | Lets modern clients use the newer TLS version | It does not expose individual TLS 1.3 cipher selection | Low, with compatibility testing |
| HSTS | Tells browsers to use only HTTPS for a period | Certificate renewal, origin HTTPS, or mixed content | High; browsers remember the policy |
Finish end-to-end TLS first
Proceed only after Full strict and the origin certificate are stable. If you publish a long HSTS policy and later disable HTTPS or let a certificate fail, browsers that remember the policy can remain unable to connect until Max-Age expires.
Recommended release order
Capture the baseline
curl -sS -I http://www.example.com/
curl -sS -I https://www.example.com/Record status codes, Location, certificate coverage, and the current redirect chain. Test the homepage, sign-in entry, and one static asset so a cached path does not become your only evidence.
Enable Always Use HTTPS
In SSL/TLS → Edge Certificates, enable Always Use HTTPS. It applies across the zone. If the origin also performs redirects, retain one clear canonicalization path so HTTP/HTTPS and www/apex rules do not chase each other.
curl -sS -I http://www.example.com/The request should reach the intended https:// URL in a bounded number of redirects. Always Use HTTPS does not rewrite HTTP assets inside the document. Fix application output first, then evaluate Automatic HTTPS Rewrites if needed.
Audit the minimum TLS version
Minimum TLS is the oldest version you accept; it does not force every client to use TLS 1.3. A modern public site can consider TLS 1.2 after reviewing logs and client requirements. Legacy devices, embedded clients, and old APIs require a test hostname first. The zone-level setting covers every hostname; a per-hostname minimum requires Advanced Certificate Manager.
curl -sS -I --tls-max 1.1 https://www.example.com/When the minimum is TLS 1.2, this legacy-protocol test should fail the handshake. Do not infer compatibility from one modern browser.
Enable and verify TLS 1.3
Enable TLS 1.3 under SSL/TLS → Edge Certificates. It applies to the entire zone, is currently available on all plans, and does not provide individual TLS 1.3 cipher selection.
openssl s_client -connect www.example.com:443 \
-servername www.example.com -tls1_3 </dev/nullInspect the negotiated protocol and certificate hostname. This command requires a local OpenSSL build with TLS 1.3 support; otherwise, cross-check in the browser Security panel.
Introduce HSTS last
Verify that every subdomain you intend to cover can sustain valid HTTPS. Then open SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS) and start with a short Max-Age. Observe certificate renewal, legacy hosts, and third-party services before extending it.
includeSubDomains extends the promise to every subdomain. preload also places it in browser preload lists, and removal is not immediate. Select them only when the entire domain tree meets the requirements and can maintain them over time.
Acceptance matrix
| Check | Expected | Inspect first on failure |
|---|---|---|
| HTTP homepage | Redirects to one canonical HTTPS URL | Redirect Rules, origin redirects, encryption mode |
| HTTPS homepage | Valid certificate and no loop | Edge Certificates, SAN, clock, certificate chain |
| TLS 1.1 maximum test | Handshake fails when minimum is TLS 1.2 | Minimum TLS setting on the target zone |
| TLS 1.3 test | Negotiates TLS 1.3 | Client support, zone setting, intermediate network |
| Response headers | Strict-Transport-Security only after HSTS is enabled | Host coverage, Max-Age, rule scope |
The next chapter separates HTTP/2, HTTP/3, and 0-RTT above the TLS layer.
Primary sources
Did this page help you complete your goal?
Beta feedback is generated in this browser and is never uploaded automatically.
03 · Establish end-to-end SSL/TLS
Separate visitor-to-Cloudflare and Cloudflare-to-origin connections, configure Origin CA and Full strict, and diagnose 525, 526, or redirect loops.
05 · HTTP/2, HTTP/3, and 0-RTT
Understand the protocol boundary between visitors, Cloudflare, and the origin, enable HTTP/3 safely, and decide whether 0-RTT fits the application.