TLS 1.0 and 1.1 listening on free version

Website, Application, Performance
1

What is the name of the domain?

What is the issue you’re encountering

TLS 1.0 and 1.1 are disabled on the webserver, but can still get to the server through cloudflare proxy

What steps have you taken to resolve the issue?

Ensured that TLS are disabled on the webserver and similar services. I am surprised that it still works, despite the protocols on the webserver side being disabled. First, how is this possible, and second is there a security concern that it is somehow working through cloudflare? I have the free version of cloudflare enabled, so I don’t have the option to disable it.

What are the steps to reproduce the issue?

Scanned with ssllabs.com and www.cdn77.com. As a secondary test, I disabled all tls versions on my pale moon browser and was still able to navigate to the server.

2

Cloudflare is a reverse proxy. Users connect to the Cloudflare edge and then if needed Cloudflare makes requests tot he origin. The control of TLS for user to Cloudflare’s edge is controlled with Cloudflare TLS settings.

2 Likes
3

This topic was automatically closed after 15 days. New replies are no longer allowed.