How to setup Advanced Certificate Manager

[james.leetong]

I am trying to disable “weak” ciphers, one of the post i read here is to buy the advanced certificate manager so that i can disable it there. however, before i buy it, i need some info on how to configure the ACM. tried searching youtube and this site but no step-by-step guide to show how to setup the new cert.

will the cert from ACM be a wildcard as well just like the universal cert? Will it be coming from cloudflare as well?

[sdayman]

For ACM, you have to specify the hostnames, which may include a wildcard. You can also choose the CA for it: Either Let’s Encrypt, or DigiCert (the CA for “Cloudflare” certs).

https://api.cloudflare.com/#zone-settings-change-ciphers-setting

How can we disable weak ciphers

I’ve had cases where legacy TLS has become active. A support ticket indicated to drop the minimum TLS and raise it again to redeploy if this happens. (Turn it off and on again!) Even with minimum TLS set to TLS v1.2 there are some ciphers that would be considered weak. I use ACM with this API call to disable ciphers I don’t need: curl -s -X PATCH "https://api.cloudflare.com/client/v4/zones/${zoneid}/settings/ciphers" -H "X-Auth-Email: ${auth_email}" -H "X-Auth-Key: ${auth_key}" -H "Content-Ty…

[james.leetong]

Thanks for the reply @sdayman. will the certificate loading/renewal be automatically done by Cloudflare or do we need to do it ourselves? Will there be extra charges if we use DigiCert aside from the $10 monthly charge?

[sdayman]

ACM auto-renews just like any other cert here.

No charge for choosing Let’s Encrypt or DigiCert. Still $10/month.