Check ID: zone_min_tls_version_secure
Provider: Cloudflare
Service: zone
Severity: HIGH
Categories: encryption
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for minimum TLS version configuration by checking if the version is set to at least TLS 1.2 to ensure connections use secure, modern cryptographic protocols.

​
Risk

Allowing legacy TLS versions (1.0, 1.1) exposes connections to known protocol vulnerabilities.
  • Confidentiality: BEAST, POODLE, and weak cipher suites can be exploited for traffic decryption
  • Compliance: TLS 1.0/1.1 are deprecated by PCI-DSS, NIST, and major browsers
  • Integrity: downgrade attacks can force weaker encryption that is susceptible to tampering

​
Recommendation

Set minimum TLS version to 1.2 or higher.
  • TLS 1.0 and 1.1 are deprecated by all major browsers and contain known vulnerabilities
  • Consider setting to TLS 1.3 for environments with modern client requirements
  • Test client compatibility before upgrading minimum version

​
Remediation

# Set minimum TLS version to 1.2 for secure connections
resource "cloudflare_zone_setting" "min_tls_version" {
  zone_id    = "<ZONE_ID>"
  setting_id = "min_tls_version"
  value      = "1.2" # Critical: blocks legacy TLS 1.0/1.1 connections
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_min_tls_version_secure. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks