Newbie Alert! Consumer of my WebService complains about Ciphers - help please

[fritex]

@jason128

The ciphers we support are:
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA256

They support only those for TLS 1.3 any no other?

@jason128

Advanced certifate manager”, so I purchased that

@jason128

API to change

The TLSv1.3 ciphers cannot be changed, but there is no known issues with the three that Cloudflare support by default.

Source article:

Cipher suites · Cloudflare SSL/TLS docs

Helpful post:

How can we disable weak ciphers

I’ve had cases where legacy TLS has become active. A support ticket indicated to drop the minimum TLS and raise it again to redeploy if this happens. (Turn it off and on again!) Even with minimum TLS set to TLS v1.2 there are some ciphers that would be considered weak. I use ACM with this API call to disable ciphers I don’t need: curl -s -X PATCH "https://api.cloudflare.com/client/v4/zones/${zoneid}/settings/ciphers" -H "X-Auth-Email: ${auth_email}" -H "X-Auth-Key: ${auth_key}" -H "Content-Ty…

Article for reset and use API for Legacy in case you haven’t tried yet, otherwise as the articles states to use Advanced Certificate Manager. Please, consider that TLSv1.2 is still used, therefrom don’t disable it’s ciphers:

Customize cipher suites · Cloudflare SSL/TLS docs