Reference
For more on Cloudflare SSL/TLS, refer to these articles:
Cipher suites: Cipher suites are a combination of ciphers used to negotiate security settings during the SSL/TLS handshake (and therefore separate from the SSL/TLS protocol).
- TLS protocols: Cloudflare supports a variety of TLS protocols, ranging from TLS 1.0 to TLS 1.3.
- Certificate and hostname priority: Learn about how Cloudflare decides which certificate (and the associated SSL/TLS settings) apply to individual hostnames.
- Certificate authorities: Learn more about the certificate authorities Cloudflare uses to issue Universal, Advanced, or SSL for SaaS certificates.
- Browser compatibility: Cloudflare attempts to provide compatibility for as wide a range of user agents (browsers, API clients, etc.) as possible. The specific set of supported browsers differs by SSL product, however. See below for specific details.
- Migration guides: These guides walk you through the migration processes associated with various changes in Cloudflare’s SSL/TLS infrastructure.
- Certificate pinning: Cloudflare does not support HTTP public key pinning (HPKP) for Universal, Advanced, or Custom Hostname certificates.
- Certificate statuses: Certificates statuses show which stage of the issuance process each certificate is in.
- Validation backoff schedule: Domain control validation (DCV) has to happen before a Certificate Authority (CA) will issue a certificate for a domain. If DCV fails, Cloudflare automatically retries it on a schedule.
- Validity periods: When you order an advanced certificate, you can select the following values for the Certificate validity period: