Require forward-secret ciphers on Cloudflare

Why it matters

The server accepts ciphers where one stolen private key can decrypt all recorded past traffic. Forward-secret ciphers (ECDHE) are supported by every current client.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Cloudflare's default edge cipher list still includes 3DES and suites with RSA key exchange. Changing it, for the zone or for one hostname, needs Advanced Certificate Manager (zone level in the dashboard or API, hostname level in the API only).
2. After any change, test with the nmap command from the generic entry, and note the previous setting so you can revert it.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the cipher suites check
• Disable the RC4 cipher
• Disable the 3DES cipher
• Offer modern AEAD ciphers
• Retire the old TLS versions that use CBC ciphers