Back to Checks
cloudflare

TLS 1.3 is enabled

zone_tls_1_3_enabled
Service: zoneSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Zone

Cloudflare zones are assessed for TLS 1.3 configuration by checking if it is enabled to benefit from improved security through simplified cipher suites and faster handshakes with zero round-trip time resumption.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Without TLS 1.3, connections use older TLS versions with less secure characteristics.

  • Confidentiality: legacy TLS versions have more complex cipher negotiations that may expose weaknesses
  • Integrity: older protocols lack protection against downgrade attacks that TLS 1.3 provides
  • Performance: slower handshakes impact user experience and increase latency

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_tls_1_3_enabled

Recommendation

Enable TLS 1.3 to provide the most secure and efficient TLS connections.

  • All modern browsers support TLS 1.3 ensuring broad compatibility
  • TLS 1.3 removes obsolete cryptographic algorithms
  • Zero round-trip time (0-RTT) resumption improves performance
  • Combine with minimum TLS version set to 1.2 or higher

Remediation

Terraform

# Enable TLS 1.3 for improved security and performance
resource "cloudflare_zone_settings_override" "tls_settings" {
  zone_id = "<ZONE_ID>"
  settings {
    tls_1_3 = "on" # Critical: enables most secure TLS version with faster handshakes
  }
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to SSL/TLS > Edge Certificates
3Scroll to TLS 1.3
4Toggle the setting to On
5Verify that your clients support TLS 1.3 (all modern browsers do)

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client


class zone_tls_1_3_enabled(Check):
    """Ensure that TLS 1.3 is enabled for Cloudflare zones.

    TLS 1.3 provides improved security through simplified cipher suites and
    faster handshakes with zero round-trip time (0-RTT) resumption. It removes
    outdated cryptographic algorithms, reduces handshake latency, and provides
    better forward secrecy compared to previous TLS versions.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the TLS 1.3 enabled check.

        Iterates through all Cloudflare zones and verifies that TLS 1.3 is
        enabled. The check accepts both "on" (standard TLS 1.3) and "zrt"
        (TLS 1.3 with 0-RTT) as valid enabled states.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if TLS 1.3
            is enabled, or FAIL status if it is disabled for the zone.
        """
        findings = []
        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )
            tls_1_3 = (zone.settings.tls_1_3 or "").lower()
            if tls_1_3 in ["on", "zrt"]:
                report.status = "PASS"
                report.status_extended = f"TLS 1.3 is enabled for zone {zone.name}."
            else:
                report.status = "FAIL"
                report.status_extended = f"TLS 1.3 is not enabled for zone {zone.name}."
            findings.append(report)
        return findings

References