Back to Checks
cloudflare

Minimum TLS version is set to 1.2 or higher

zone_min_tls_version_secure
Service: zoneSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Zone

Cloudflare zones are assessed for minimum TLS version configuration by checking if the version is set to at least TLS 1.2 to ensure connections use secure, modern cryptographic protocols.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Allowing legacy TLS versions (1.0, 1.1) exposes connections to known protocol vulnerabilities.

  • Confidentiality: BEAST, POODLE, and weak cipher suites can be exploited for traffic decryption
  • Compliance: TLS 1.0/1.1 are deprecated by PCI-DSS, NIST, and major browsers
  • Integrity: downgrade attacks can force weaker encryption that is susceptible to tampering

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_min_tls_version_secure

Recommendation

Set minimum TLS version to 1.2 or higher.

  • TLS 1.0 and 1.1 are deprecated by all major browsers and contain known vulnerabilities
  • Consider setting to TLS 1.3 for environments with modern client requirements
  • Test client compatibility before upgrading minimum version

Remediation

Terraform

# Set minimum TLS version to 1.2 for secure connections
resource "cloudflare_zone_setting" "min_tls_version" {
  zone_id    = "<ZONE_ID>"
  setting_id = "min_tls_version"
  value      = "1.2" # Critical: blocks legacy TLS 1.0/1.1 connections
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to SSL/TLS > Edge Certificates
3Scroll to Minimum TLS Version
4Select TLS 1.2 or TLS 1.3 from the dropdown
5Verify that your clients support the selected TLS version

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client


class zone_min_tls_version_secure(Check):
    """Ensure that minimum TLS version is set to 1.2 or higher for Cloudflare zones.

    TLS 1.0 and 1.1 have known vulnerabilities (BEAST, POODLE) and are deprecated.
    Setting the minimum TLS version to 1.2 or higher ensures that only secure
    cipher suites are used for encrypted connections, protecting against
    downgrade attacks and known cryptographic weaknesses.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the minimum TLS version check.

        Iterates through all Cloudflare zones and verifies that the minimum
        TLS version is configured to 1.2 or higher. The check parses the
        min_tls_version setting as a float for comparison, defaulting to 0
        if the value cannot be parsed.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if the
            minimum TLS version is 1.2 or higher, or FAIL status if older
            TLS versions (1.0, 1.1) are still allowed.
        """
        findings = []

        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )
            current_version = zone.settings.min_tls_version or "0"
            try:
                current = float(current_version)
            except ValueError:
                current = 0

            if current >= 1.2:
                report.status = "PASS"
                report.status_extended = f"Minimum TLS version for zone {zone.name} is set to {current_version}."
            else:
                report.status = "FAIL"
                report.status_extended = f"Minimum TLS version for zone {zone.name} is {current_version}, below the recommended 1.2."
            findings.append(report)
        return findings

References