Edge Certificate Settings Not Taking Effect

[greg46]

What is the name of the domain?

kerrnel.com

What is the issue you’re encountering

My edge certificate ssl settings aren’t taking effect

What steps have you taken to resolve the issue?

I enabled settings like HSTS and minimum SSL version 1.3, but look in SSL Labs and my site still advertises no HSTS, etc.: SSL Server Test: kerrnel.com (Powered by Qualys SSL Labs)

Was the site working with SSL prior to adding it to Cloudflare?

Yes

What is the current SSL/TLS setting?

Full (strict)

What are the steps to reproduce the issue?

See SSL Server Test: kerrnel.com (Powered by Qualys SSL Labs)

[fritex]

@greg46

My edge certificate ssl settings aren’t taking effect

How so?
Your Website loads fine over HTTPS using Cloudflare as far as I can see and tested few moments ago:

@greg46

Full (strict)

@greg46

look in SSL Labs and my site still advertises no HSTS, etc.

I don’t se HSTS header (Strict-Transport-Security) being present anymore in a response:

$ curl -I https://kerrnel.com/
HTTP/2 200
date: Sun, 10 Nov 2024 19:25:56 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=0, must-revalidate
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 8e086e6bfacdc228-VIE

[greg46]

I want the HSTS headers to go through like they did when I ran my own apache2 server. I worked in web browser security for year (not anymore) so it’s just sort of near and dear to my heart and, frankly, it should be reliable for cloudflare users to get best practices like HSTS headers.

Checking the headers confirms there’s no HSTS headers being sent.

[greg46]

These are my settings so it should be working

[fritex]

@greg46

I want the HSTS headers to go through like they did when I ran my own apache2 server.

May I ask if you’ve enabled HSTS at Cloudflare under the SSL/TLS tab → Edge Certificates, or via next link https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls/edge-certificates/ ?

Helpful article:

HTTP Strict Transport Security (HSTS) | Cloudflare SSL/TLS docs

[greg46]

I see the problem - it was an issue with how the UX got rendered in firefox. For some reason it auto scrolled down so I never saw the HSTS button at the top, and I thought the other buttons enabled it. Wow, easy miss! Thank you

[greg46]

Out of pure curiosity, do you know why it isn’t forcing TLS 1.3? This isn’t really important but it’s interesting to me as a cyber security person.

[fritex]

@greg46

HSTS

Now I confirm I do see HSTS headers being present:

$ curl -I https://kerrnel.com/
HTTP/2 200
date: Sun, 10 Nov 2024 19:33:01 GMT
...
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
strict-transport-security: max-age=15552000; includeSubDomains; preload
server: cloudflare
...

[greg46]

I believe TLSv1.2 is still being advertised per the output of

curl https://kerrnel.com -svo /dev/null --tls-max 1.2

* SSL connection using TLSv1.2 / ECDHE-ECDSA-CHACHA20-POLY1305 / [blank] / UNDEF
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=kerrnel.com
*  start date: Nov 10 16:55:25 2024 GMT
*  expire date: Feb  8 17:55:20 2025 GMT
*  subjectAltName: host "kerrnel.com" matched cert's "kerrnel.com"
*  issuer: C=US; O=Google Trust Services; CN=WE1
*  SSL certificate verify ok.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://kerrnel.com/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: kerrnel.com]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.7.1]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: kerrnel.com
> User-Agent: curl/8.7.1
> Accept: */*

[fritex]

@greg46

why it isn’t forcing TLS 1.3

You mean, why the HSTS option doesn’t force TLS v.1.3 be default?

I am not aware if that’s interconnected within Cloudflare code, however possibly we could expect this in some soon future.

Nevertheless, the Minimum TLS version option is there separately I believe because quite a lot requests still go with 1.2 of nowadays Web browsers, despite TLS v1.3 is supported, however we can expect this to be “normal” as 1.3 in next coming years, my best guess.

Using TLS v.1.3 only would block some portion of users trying to access your Website.

It’s good to keep it as Minimum TLS v1.2 for now on.

[greg46]

No I have it enabled it the UX to be TLS V1.3 only.

TLSv1.3 gets rid of a lot of weak cipher suites. Now does it matter for a personal static website that there are some theoretically weak cipher suites being used? No, but it’s weird the option doesn’t do anything, right? A bug?

[greg46]

FWIW someone explains this issue here and the reason is totally rational: "Minimum TLS Version" = 1.3 doesn't work when the origin is a Cloudflare Pages site

Thanks for solving my HSTS issue! We can close this

[fritex]

@greg46

TLSv1.3 gets rid of a lot of weak cipher suites.

I agree, yes.

@greg46

theoretically weak cipher suites being used

Qualys SSL Labs would report them, yes.
It could be done via an API to modify ciphers settings (allowlist):

Cloudflare API Documentation

Helpful article for cipher suites:

Cipher suites | Cloudflare SSL/TLS docs

However, I am afraid this would require you to have an Advanced Certificate Manager subscription purchased for $5/month for your zone (which would also allow you to have e.g sub.sub.domain.com as an deep-level sub-domains covered with Cloudflare’s Universal SSL):

How can we disable weak ciphers

I’ve had cases where legacy TLS has become active. A support ticket indicated to drop the minimum TLS and raise it again to redeploy if this happens. (Turn it off and on again!) Even with minimum TLS set to TLS v1.2 there are some ciphers that would be considered weak. I use ACM with this API call to disable ciphers I don’t need: curl -s -X PATCH "https://api.cloudflare.com/client/v4/zones/${zoneid}/settings/ciphers" -H "X-Auth-Email: ${auth_email}" -H "X-Auth-Key: ${auth_key}" -H "Content-Ty…

Advanced certificates | Cloudflare SSL/TLS docs