跳转到主要内容

章节Cloudflare 开发者文档（免费档）

Ssl

137 页更新于 2 小时前

开始阅读

本章内容137

  1. 01 Changelog import { ProductChangelog } from "~/components"; {/* <!-- Actual content lives in /src/content/changelog/ss... 2 小时前
  2. 02 Concepts import { Stream, Render } from "~/components"; This page defines and articulates key concepts that are rele... 2 小时前
  3. 03 SSL/TLS FAQ import { Render } from "~/components"; Refer to this page for frequently asked questions about Cloudflare S... 2 小时前
  4. 04 Get started import { GlossaryDefinition, Render } from "~/components"; Set up encrypted connections for your domain by ... 2 小时前
  5. 05 Cloudflare SSL/TLS import { Description, Feature, Plan, RelatedProduct } from "~/components"; Encrypt your web traffic to prev... 2 小时前
  6. 06 Bring your own CA for mTLS import { APIRequest, Render, TabItem, Tabs, DashButton } from "~/components"; This page explains how you ca... 2 小时前
  7. 07 Client certificate variables When a request includes a client certificate for mTLS authentication, Cloudflare exposes certificate detail... 2 小时前
  8. 08 Configure your mobile app or IoT device This tutorial demonstrates how to configure your Internet-of-things (IoT) device and mobile application to ... 2 小时前
  9. 09 Create a client certificate import { Details, DashButton, GlossaryTooltip } from "~/components"; Use Cloudflare's public key infrastruc... 2 小时前
  10. 10 Enable mTLS import { Render, DashButton } from "~/components"; You can enable mutual Transport Layer Security (mTLS) fo... 2 小时前
  11. 11 Forward certificate to server import { Render } from "~/components"; 2 小时前
  12. 12 Client certificates (mTLS) import { GlossaryDefinition, Render, DirectoryListing } from "~/components"; Standard TLS verifies the serv... 2 小时前
  13. 13 Label client certificates After creating client certificates at Cloudflare, it may be hard to differentiate the generated certificate... 2 小时前
  14. 14 Revoke a client certificate import { DashButton } from "~/components"; You can revoke a client certificate you previously generated wit... 2 小时前
  15. 15 Troubleshooting import { DashButton, Render, Steps, TypeScriptExample } from "~/components"; If your query returns an error... 2 小时前
  16. 16 Backup certificates If Cloudflare is providing authoritative DNS for your domain, Cloudflare will issue a backup Universal SSL ... 2 小时前
  17. 17 Add CAA records import { Render, TabItem, Tabs, DashButton } from "~/components"; For additional security, set up Certifi... 2 小时前
  18. 18 ECH Protocol import { DashButton } from "~/components"; ECH stands for Encrypted Client Hello. It is a protocol extensio... 2 小时前
  19. 19 Enforce HTTPS connections Even with an active SSL/TLS certificate, visitors can still access resources over unsecured HTTP connection... 2 小时前
  20. 20 Edge certificates import { GlossaryTooltip } from "~/components"; Edge certificates are the SSL/TLS certificates that Cloudfl... 2 小时前
  21. 21 Staging environment import { DashButton } from "~/components" Use your certificate staging environment to test new custom (mode... 2 小时前
  22. 22 Always Use HTTPS import { Render } from "~/components"; Always Use HTTPS redirects all your visitor requests from http to ... 2 小时前
  23. 23 Automatic HTTPS Rewrites import { Render, TabItem, Tabs, DashButton } from "~/components"; Automatic HTTPS Rewrites prevents end use... 2 小时前
  24. 24 Certificate Signing Requests (CSRs) import { Render, DashButton } from "~/components"; Availability Free Pro Business Enterprise Availability N... 2 小时前
  25. 25 Certificate Transparency Monitoring import { GlossaryTooltip } from "~/components"; Certificate Transparency (CT) Monitoring is an opt-in featu... 2 小时前
  26. 26 HTTP Strict Transport Security (HSTS) import { TabItem, Tabs, DashButton } from "~/components"; HSTS protects HTTPS web servers from downgrade at... 2 小时前
  27. 27 Additional options import { DirectoryListing } from "~/components" Once you set up SSL/TLS on your application, you can adjust... 2 小时前
  28. 28 Minimum TLS Version import { TabItem, Tabs, APIRequest, Render, DashButton } from "~/components"; Minimum TLS Version only allo... 2 小时前
  29. 29 Opportunistic Encryption import { Render, TabItem, Tabs, DashButton } from "~/components"; Opportunistic Encryption allows browsers ... 2 小时前
  30. 30 TLS 1.3 import { Details, Render, TabItem, Tabs, DashButton } from "~/components"; TLS 1.3 enables the latest versi... 2 小时前
  31. 31 Compliance standards import { Render, Details } from "~/components"; Consider the following recommendations on custom cipher sui... 2 小时前
  32. 32 Cipher suites import { DirectoryListing, Render } from "~/components"; This section covers cipher suites used in connecti... 2 小时前
  33. 33 Security levels import { Render, Details } from "~/components"; Refer to the sections below for three different security le... 2 小时前
  34. 34 Supported cipher suites Cloudflare supports the following cipher suites by default. If needed, you can restrict your website or app... 2 小时前
  35. 35 Troubleshooting import { Render } from "~/components"; If you encounter issues with edge certificate cipher suites, refer t... 2 小时前
  36. 36 Customize cipher suites via API import { Render, TabItem, Tabs, APIRequest } from "~/components"; Prerequisites Before you begin Note that:... 2 小时前
  37. 37 Customize cipher suites via dashboard import { Render, Details, DashButton } from "~/components"; Prerequisites Selection modes When configuring ... 2 小时前
  38. 38 Customize cipher suites import { Render, TabItem, Tabs, DirectoryListing } from "~/components"; With an Advanced Certificate Manage... 2 小时前
  39. 39 Enable import { Render, TabItem, Tabs, DashButton } from "~/components"; To enable Total TLS - which issues indivi... 2 小时前
  40. 40 Error messages import { Render } from "~/components"; To help avoid ERR_SSL_VERSION_OR_CIPHER_MISMATCH errors, Cloudflare... 2 小时前
  41. 41 Total TLS import { DirectoryListing, Render } from "~/components"; Total TLS allows Cloudflare to issue individual ce... 2 小时前
  42. 42 API commands Use the following API commands to manage advanced certificates. If you are using our API for the first time... 2 小时前
  43. 43 Advanced certificates import { DirectoryListing, GlossaryTooltip, Render, } from "~/components"; To order advanced certificates, ... 2 小时前
  44. 44 Manage advanced certificates import { AvailableNotifications, Render, TabItem, Tabs, DashButton } from "~/components"; Create a certific... 2 小时前
  45. 45 Domain control validation flow import { Render } from "~/components"; To obtain Universal, Advanced, and Custom hostname certificates, Clo... 2 小时前
  46. 46 Domain control validation (DCV) import { Render } from "~/components"; If DCV is not completed, the CA cannot issue or renew the certificat... 2 小时前
  47. 47 Troubleshooting import { GlossaryTooltip, Render, Tabs, TabItem } from "~/components"; If your certificate is stuck in Pend... 2 小时前
  48. 48 Validation backoff schedule import { Render } from "~/components"; Domain control validation (DCV) has to happen before a certificate a... 2 小时前
  49. 49 Delegated import { Example, Render } from "~/components"; Delegated DCV allows zones with partial DNS setups - meanin... 2 小时前
  50. 50 HTTP import { Details, Render } from "~/components"; When you choose HTTP DCV, Cloudflare automatically adds a v... 2 小时前
  51. 51 Methods import { DirectoryListing, Render } from "~/components"; Perform DCV For details on each method available f... 2 小时前
  52. 52 TXT import { Render, TabItem, Tabs } from "~/components"; When to use Generally, you need to perform TXT-base... 2 小时前
  53. 53 Bundle methodologies import { Tabs, TabItem } from "~/components"; When an SSL certificate is deployed to Cloudflare's global ne... 2 小时前
  54. 54 Custom certificates import { Render } from "~/components"; Use custom certificates when you need control over the certificate... 2 小时前
  55. 55 Remove key file password import { Details } from "~/components"; You cannot upload a custom certificate with a password-protected ke... 2 小时前
  56. 56 Renewal and expiration import { GlossaryTooltip, DashButton } from "~/components" Renew custom certificates Since Cloudflare canno... 2 小时前
  57. 57 Troubleshooting Make sure your key and certificate match You can use an external tool such as the SSLShopper Certificate Ke... 2 小时前
  58. 58 Manage custom certificates import { Details, GlossaryTooltip, Render, TabItem, Tabs, APIRequest, DashButton, } from "~/components"; Th... 2 小时前
  59. 59 Geo Key Manager import { CardGrid, Description, DirectoryListing, LinkTitleCard, RelatedProduct, Render, } from "~/componen... 2 小时前
  60. 60 Setup import { Render, TabItem, Tabs, InlineBadge, APIRequest, Example, } from "~/components"; Geo Key Manager v2... 2 小时前
  61. 61 Supported options For customers with Geo Key Manager v2, you can use the policy parameter to specify following regions using... 2 小时前
  62. 62 Alerts import { AvailableNotifications, Render } from "~/components" You can configure alerts to receive notificat... 2 小时前
  63. 63 Disable Universal SSL certificates import { TabItem, Tabs, DashButton } from "~/components"; Some customers may need to manage their own SSL c... 2 小时前
  64. 64 Enable Universal SSL certificates import { GlossaryDefinition, Render } from "~/components"; The process for activating a Universal SSL certi... 2 小时前
  65. 65 Universal SSL import { GlossaryDefinition, Render } from "~/components"; On a full setup, Universal SSL certificates cove... 2 小时前
  66. 66 Limitations import { GlossaryTooltip, Render } from "~/components"; Universal SSL certificates present some limitations... 2 小时前
  67. 67 Troubleshooting If a certificate issuance times out, Cloudflare tells you where in the chain of issuance the timeout occurr... 2 小时前
  68. 68 Glossary The key server is a daemon that you run on your own infrastructure. The key server receives inbound request... 2 小时前
  69. 69 Keyless SSL import { Render } from "~/components"; Before configuring Keyless SSL, you should read our technical back... 2 小时前
  70. 70 Troubleshooting To check logs, use a command similar to the following. systemd: sudo journalctl -f -u gokeyless upstart/sy... 2 小时前
  71. 71 Upgrade your key server Periodically, you may need to update your key server when using Cloudflare's Keyless SSL. To upgrade your k... 2 小时前
  72. 72 Cloudflare Tunnel import { Render } from "~/components"; Through an integration with Cloudflare Tunnel, you can send traffic ... 2 小时前
  73. 73 Get started import { DirectoryListing } from "~/components" The way you set up Keyless SSL depends on how you route tra... 2 小时前
  74. 74 Public DNS import { Render, TabItem, Tabs, DashButton } from "~/components"; If you cannot use a Cloudflare Tunnel set... 2 小时前
  75. 75 Run with Docker The gokeyless key server is published as a container image, and most settings can be configured with envir... 2 小时前
  76. 76 AWS cloud HSM :::note[Note] This example imports an existing key pair, but you may prefer to generate your key on the HSM... 2 小时前
  77. 77 Azure Dedicated HSM This tutorial uses Azure Dedicated HSM — a FIPS 140-2 Level 3 certified implementation based on the Gemalto... 2 小时前
  78. 78 Azure Managed HSM This tutorial uses Microsoft Azure’s Managed HSM — a FIPS 140-2 Level 3 certified implementation — to deplo... 2 小时前
  79. 79 Configuration :::caution[Important] Carefully review the manufacturer documentation for your HSM and properly restrict ac... 2 小时前
  80. 80 Entrust nShield Connect :::note[Note] This example assumes you have already configured the nShield Connect device and generated or ... 2 小时前
  81. 81 Fortanix Data Security Manager import { Example } from "~/components"; You can use Cloudflare Keyless SSL with Fortanix Data Security Mana... 2 小时前
  82. 82 Google Cloud HSM This tutorial uses Google Cloud HSM — a FIPS 140-2 Level 3 certified implementation. Before you start Make ... 2 小时前
  83. 83 IBM Cloud HSM The example below was tested using IBM Cloud HSM 7.0, a FIPS 140-2 Level 3 certified implementation based o... 2 小时前
  84. 84 Hardware security modules In addition to private keys stored on disk, Keyless SSL supports keys stored in a Hardware Security Module ... 2 小时前
  85. 85 SoftHSMv2 :::caution[Important] SoftHSMv2 should not be considered any more secure than storing private keys directly... 2 小时前
  86. 86 High availability The Cloudflare Keyless SSL server runs as a single binary with minimal dependencies and is designed to be r... 2 小时前
  87. 87 Reference import { DirectoryListing } from "~/components" For more information on Keyless SSL, refer to the following... 2 小时前
  88. 88 Keyless delegation Keyless Delegation is Cloudflare's implementation of the emerging delegated credentials standard (RFC 9345)... 2 小时前
  89. 89 Key server metrics The gokeyless key server exposes a Prometheus metrics endpoint that you can use to monitor signing performa... 2 小时前
  90. 90 Scaling and benchmarking Cloudflare's Keyless SSL technology was designed to scale to accommodate any sized workload using vertical ... 2 小时前
  91. 91 Automatic key exchange to origins import { DashButton, Steps } from "~/components"; Automatic key exchange allows Cloudflare to establish fas... 2 小时前
  92. 92 Cipher suites Refer to the following list to know what cipher suites Cloudflare presents to origin servers during an SSL/... 2 小时前
  93. 93 Custom Origin Trust Store import { Render, DashButton } from "~/components"; By default, Cloudflare's global network maintains a list... 2 小时前
  94. 94 Origin server import { DirectoryListing } from "~/components" Learn more about SSL/TLS protection options for your origin... 2 小时前
  95. 95 SSL/TLS Recommender import { Render, TabItem, Tabs, DashButton } from "~/components"; The SSL/TLS Recommender helps you choose ... 2 小时前
  96. 96 AWS integration import { Render, APIRequest } from "~/components"; This guide will walk you through how to set up per-hostn... 2 小时前
  97. 97 About When visitors request content from your domain, Cloudflare first attempts to serve content from the cache. ... 2 小时前
  98. 98 Authenticated Origin Pulls (mTLS) import { Render } from "~/components"; Authenticated Origin Pulls (AOP) helps ensure requests to your origi... 2 小时前
  99. 99 Global import { Render, Tabs, TabItem, DashButton } from "~/components"; When you enable global Authenticated Orig... 2 小时前
  100. 100 Setup import { DirectoryListing } from "~/components" 2 小时前
  101. 101 Manage certificates import { APIRequest } from "~/components"; Refer to the following sections to learn how to manage certifica... 2 小时前
  102. 102 Per-hostname import { AvailableNotifications, Render, Details, Tabs, TabItem, DashButton, } from "~/components"; When yo... 2 小时前
  103. 103 Roll back per-hostname AOP import { Render } from "~/components"; If you need to disable or remove your per-hostname Authenticated Ori... 2 小时前
  104. 104 Zone-level import { AvailableNotifications, Render, Details, Tabs, TabItem, DashButton, } from "~/components"; When yo... 2 小时前
  105. 105 Cloudflare origin CA import { Details, Render, TabItem, Tabs, DashButton, GlossaryTooltip, } from "~/components"; If your origin... 2 小时前
  106. 106 Troubleshooting Cloudflare origin CA import { GlossaryTooltip, Render, DashButton } from "~/components"; Consider the following common issues an... 2 小时前
  107. 107 Flexible import { Render, TabItem, Tabs } from "~/components"; Setting your encryption mode to Flexible makes your s... 2 小时前
  108. 108 Full (strict) import { Render, TabItem, Tabs } from "~/components"; When you set your encryption mode to Full (strict), C... 2 小时前
  109. 109 Full import { Stream, Render, TabItem, Tabs } from "~/components"; When you set your encryption mode to Full, Cl... 2 小时前
  110. 110 Encryption modes import { DirectoryListing, Render, TabItem, Tabs, APIRequest, } from "~/components"; If possible, Cloudfl... 2 小时前
  111. 111 Off (no encryption) import { Render, TabItem, Tabs } from "~/components"; Setting your encryption mode to Off (not recommended)... 2 小时前
  112. 112 Strict (SSL-Only Origin Pull) import { Stream, Render, Tabs, TabItem } from "~/components"; :::note This method is only available for Ent... 2 小时前
  113. 113 Post-quantum cryptography (PQC) Post-quantum cryptography (PQC) refers to cryptographic algorithms that have been designed to resist attack... 2 小时前
  114. 114 Post-quantum cryptography in Cloudflare One Cloudflare One replaces legacy corporate security perimeters with Cloudflare's global network, making acces... 2 小时前
  115. 115 PQC in Cloudflare products Cloudflare is targeting 2029 to be fully post-quantum secure across its entire product suite. This page sho... 2 小时前
  116. 116 PQC support The sections below summarize third-party software support for the post-quantum algorithms Cloudflare has de... 2 小时前
  117. 117 Post-quantum between Cloudflare and origin servers import { Example } from "~/components"; This page covers post-quantum cryptography on the TLS connection be... 2 小时前
  118. 118 Browser compatibility Cloudflare attempts to provide compatibility for as wide a range of user agents (browsers, API clients, etc... 2 小时前
  119. 119 Certificate and hostname priority import { GlossaryTooltip } from "~/components"; When a new certificate is created, Cloudflare first deploys... 2 小时前
  120. 120 Certificate authorities import { Render } from "~/components"; For publicly trusted certificates, Cloudflare partners with differen... 2 小时前
  121. 121 Certificate pinning import { GlossaryTooltip } from "~/components"; Cloudflare does not support HTTP public key pinning (HPKP) ... 2 小时前
  122. 122 Rotate ACM certificate packs import { DashButton, TabItem, Tabs } from "~/components"; Advanced Certificate Manager (ACM) certificate pa... 2 小时前
  123. 123 Certificate statuses Certificates statuses show which stage of the issuance process each certificate is in. New certificates Whe... 2 小时前
  124. 124 Validity periods and renewal import { Render } from "~/components"; For certificates managed by Cloudflare, attempts to renew start at t... 2 小时前
  125. 125 Cloudflare and CVE-2019-1559 The GOLDENDOODLE and Zombie POODLE attacks affect applications that use certain cipher suites associated wi... 2 小时前
  126. 126 PCI DSS compliance import { DashButton, APIRequest } from "~/components"; The Payment Card Industry Data Security Standard (PC... 2 小时前
  127. 127 Reference import { DirectoryListing } from "~/components" For more on Cloudflare SSL/TLS, refer to these articles: 2 小时前
  128. 128 TLS protocols Cloudflare supports the following TLS protocols: TLS 1.0 TLS 1.1 TLS 1.2 TLS 1.3 TLS 1.0 is the version tha... 2 小时前
  129. 129 DigiCert Legacy Root (G1) distrust by major browsers Browsers and operating systems are completing the removal of DigiCert's legacy G1 root certificates from th... 2 小时前
  130. 130 Entrust distrust by major browsers import { Details } from "~/components"; Google Chrome and Mozilla have announced they will no longer trust ... 2 小时前
  131. 131 Migration guides import { DirectoryListing } from "~/components" These guides walk you through the migration processes assoc... 2 小时前
  132. 132 ERR_SSL_PROTOCOL_ERROR import { DashButton } from "~/components"; If visitors to your site experience SSL protocol errors such as:... 2 小时前
  133. 133 General SSL errors import { GlossaryTooltip, DashButton } from "~/components"; Let's Encrypt chain update Symptom Starting Sep... 2 小时前
  134. 134 Troubleshooting import { ResourcesBySelector } from "~/components" For FAQs and other troubleshooting information, refer to... 2 小时前
  135. 135 Mixed content errors Domains added to Cloudflare receive SSL certificates and can serve traffic over HTTPS. However, after start... 2 小时前
  136. 136 ERR_TOO_MANY_REDIRECTS After you add a new domain to Cloudflare, your visitors' browsers might display ERR_TOO_MANY_REDIRECTS or ... 2 小时前
  137. 137 ERR_SSL_VERSION_OR_CIPHER_MISMATCH import { Stream, Render } from "~/components"; After you add a new domain to Cloudflare, your visitors' bro... 2 小时前