Configuring PCI DSS/3DS Compliance Check and TLS

Transport Layer Security (TLS) provides confidentiality and ensures data integrity for data sent between applications over the Internet. HTTPS is a network protocol constructed based on TLS and HTTP and can be used for encrypted transmission and identity authentication. If you select Cloud or Dedicated for Protection and set Client Protocol to HTTPS, set the minimum TLS version and cipher suite (a set of multiple cryptographic algorithms) for your domain name to block requests that use a TLS version earlier than the configured one.

TLS v1.0 and the cipher suite 1 are configured by default in WAF for general security. To protect your websites better, set the minimum TLS version to a later version and select a more secure cipher suite.

WAF allows you to enable PCI DSS and PCI 3DS certification checks. After PCI DSS or PCI 3DS certification check is enabled, the minimum TLS version is automatically set to TLS v1.2 to meet the PCI DSS and PCI 3DS certification requirements. The Payment Card Industry Data Security Standard (PCI DSS) is an information security standard for organizations that handle branded credit cards from the major card schemes. PCI 3-Domain Secure (PCI 3DS) is a PCI Core Security Standard.

If you have enabled enterprise projects, ensure that you have all operation permissions for the project where your WAF instance locates. Then, you can select the enterprise project from the Enterprise Project drop-down list and configure PCI DSS or PCI 3DS and TLS for the domain names.

Prerequisites

You have selected Cloud Mode - CNAME or Dedicated Mode for protection when adding the website to WAF.

If you use cloud mode - load balancer access mode, you need to configure TLS security policies on the ELB console.
Your website uses HTTPS as the client protocol.

Constraints

If Client Protocol for the website you want to protect is set to HTTP, TLS is not required, and you can skip this topic.
If you configure multiple combinations of server information, PCI DSS and PCI 3DS compliance certification checks can be set only when Client Protocol is set to HTTPS in all of those combinations.
If PCI DSS/3DS compliance check is enabled, the client protocol cannot be changed, and no servers can be added.

Application Scenarios

By default, the minimum TLS version configured for WAF is TLS v1.0. To ensure website security, configure the right TLS version for your service requirements. Table 1 lists the minimum TLS versions supported for different scenarios.

**Table 1** Minimum TLS versions supported
Scenario	Minimum TLS Version (Recommended)	Protection Effect
Websites that handle critical business data, such as sites used in banking, finance, securities, and e-commerce.	TLS v1.2	WAF automatically blocks website access requests that use TLS v1.0 or TLS v1.1.
Websites with basic security requirements, for example, small- and medium-sized enterprise websites.	TLS v1.1	WAF automatically blocks website access requests that use TLS v1.0.
Client applications with no special security requirements	TLS v1.0	Requests using any TLS protocols can access the website.

Before you configure TLS, check the TLS version of your website.

The recommended cipher suite in WAF is Cipher suite 1. Cipher suite 1 offers a good mix of browser compatibility and security. For details about each cipher suite, see Table 2.

**Table 2** Description of cipher suites
Cipher Suite Name	Cryptographic Algorithm Supported	Cryptographic Algorithm Not Supported	Description
Default cipher suite NOTE: By default, Cipher suite 1 is configured for websites. However, if the request does not carry the server name indication (SNI), WAF uses the Default cipher suite.	ECDHE-RSA-AES256-SHA384 AES256-SHA256 RC4 HIGH	MD5 aNULL eNULL NULL DH EDH AESGCM	Compatibility: Good. A wide range of browsers are supported. Security: Average
Cipher suite 1	ECDHE-ECDSA-AES256-GCM-SHA384 HIGH	MEDIUM LOW aNULL eNULL DES MD5 PSK RC4 kRSA 3DES DSS EXP CAMELLIA	Recommended configuration. Compatibility: Good. A wide range of browsers are supported. Security: Good
Cipher suite 2	EECDH+AESGCM EDH+AESGCM	-	Compatibility: Average. Strict compliance with forward secrecy requirements of PCI DSS and excellent protection, but browsers of earlier versions may be unable to access the website. Security: Excellent
Cipher suite 3	ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-SHA384 RC4 HIGH	MD5 aNULL eNULL NULL DH EDH	Compatibility: Average. Earlier versions of browsers may be unable to access the website. Security: Excellent. Multiple algorithms, such as ECDHE, DHE-GCM, and RSA-AES-GCM, are supported.
Cipher suite 4	ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-SHA384 AES256-SHA256 RC4 HIGH	MD5 aNULL eNULL NULL EDH	Compatibility: Good. A wide range of browsers are supported. Security: Average. The GCM algorithm is supported.
Cipher suite 5	AES128-SHA:AES256-SHA AES128-SHA256:AES256-SHA256 HIGH	MEDIUM LOW aNULL eNULL EXPORT DES MD5 PSK RC4 DHE	Supported algorithms: RSA-AES-CBC only
Cipher suite 6	ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES256-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-RSA-AES128-SHA256	-	Compatibility: Average Security: Good
Cipher suite 7	ECDHE-ECDSA-AES256-GCM-SHA384 HIGH	MEDIUM LOW aNULL eNULL DES MD5 PSK RC4 kRSA SRP 3DES DSS EXP CAMELLIA CBC	This cipher suite supports all algorithms in cipher suite 1, except for the CBC algorithm. Compatibility: Average. Core suite: ECDHE-ECDSA-AES256-GCM-SHA384. Old protocols and weak algorithms are disabled. Browsers of earlier versions may fail to access the system. Security: Excellent

The TLS cipher suites in WAF are compatible with all browsers and clients of later versions but are incompatible with some browsers of earlier versions. Table 3 lists the incompatible browsers and clients if the TLS v1.0 protocol is used.

It is recommended that compatibility tests should be carried out on the service environment to ensure service stability.

**Table 3** Incompatible browsers and clients for cipher suites under TLS v1.0
Browser/Client	Default Cipher Suite	Cipher Suite 1	Cipher Suite 2	Cipher Suite 3	Cipher Suite 4	Cipher Suite 5	Cipher Suite 6	Cipher Suite 7
Google Chrome 63 /macOS High Sierra 10.13.2	Not compatible	Compatible	Compatible	Compatible	Not compatible	Compatible	Compatible	√
Google Chrome 49/ Windows XP SP3	Not compatible	Not compatible	Not compatible	Not compatible	Not compatible	Compatible	Compatible	×
Internet Explorer 6 /Windows XP	Not compatible	Not compatible	Not compatible	Not compatible	Not compatible	Not compatible	Not compatible	Not compatible
Internet Explorer 8 /Windows XP	Not compatible	Not compatible	Not compatible	Not compatible	Not compatible	Not compatible	Not compatible	Not compatible
Safari 6/iOS 6.0.1	Compatible	Compatible	Not compatible	Compatible	Compatible	Compatible	Compatible	×
Safari 7/iOS 7.1	Compatible	Compatible	Not compatible	Compatible	Compatible	Compatible	Compatible	Compatible
Safari 7/OS X 10.9	Compatible	Compatible	Not compatible	Compatible	Compatible	Compatible	Compatible	Compatible
Safari 8/iOS 8.4	Compatible	Compatible	Not compatible	Compatible	Compatible	Compatible	Compatible	Compatible
Safari 8/OS X 10.10	Compatible	Compatible	Not compatible	Compatible	Compatible	Compatible	Compatible	Compatible
Internet Explorer 7/Windows Vista	Compatible	Compatible	Not compatible	Compatible	Compatible	Not compatible	√	×
Internet Explorer /Windows 7	Compatible	Compatible	Not compatible	Compatible	Compatible	Not compatible	√	×
Internet Explorer /Windows Phone 8.0	Compatible	Compatible	Not compatible	Compatible	Compatible	Not compatible	√	×
Java 7u25	Compatible	Compatible	Not compatible	Compatible	Compatible	Not compatible	√	×
OpenSSL 0.9.8y	Not compatible	Not compatible	Not compatible	Not compatible	Not compatible	Not compatible	Not compatible	Not compatible
Safari 5.1.9/OS X 10.6.8	Compatible	Compatible	Not compatible	Compatible	Compatible	Not compatible	√	×
Safari 6.0.4/OS X 10.8.4	Compatible	Compatible	Not compatible	Compatible	Compatible	Not compatible	√	×

Impact on the System

If you enable the PCI DSS certification check:
- The minimum TLS version and cypher suite are automatically set to TLS v1.2 and EECDH+AESGCM:EDH+AESGCM, respectively, and cannot be changed.
- To change the minimum TLS version and cipher suite, disable the check.
If you enable the PCI 3DS certification check:
- The minimum TLS version is automatically set to TLS v1.2 and cannot be changed.
- The check cannot be disabled.

Configuring PCI DSS/3DS Compliance Check and TLS

Log in to the management console.
Click in the upper left corner of the management console and select a region or project.
Click in the upper left corner and choose Web Application Firewall under Security & Compliance.
In the navigation pane on the left, choose Website Settings.
In the Domain Name column, click the domain name of the website to go to the basic information page.
In the Compliance Certification row, you can select PCI DSS and/or PCI 3DS to allow WAF to check your website for the corresponding PCI certification compliance. In the TLS Configuration row, click to complete TLS configuration.

Figure 1 TLS configuration modification
- Select PCI DSS. In the displayed Warning dialog box, click OK to enable the PCI DSS certification check.
  
  If PCI DSS certification check is enabled, the minimum TLS version and cypher suite cannot be changed.
- Select PCI 3DS. In the displayed Warning dialog box, click OK to enable the PCI 3DS certification check.
  - If PCI 3DS certification check is enabled, the minimum TLS version cannot be changed.
  - Once enabled, the PCI 3DS certification check cannot be disabled.
In the displayed TLS Configuration dialog box, select the minimum TLS version and cipher suite.

Figure 2 TLS Configuration
Select the minimum TLS version you need. The options are as follows:
- TLS v1.0: the default version. Requests using TLS v1.0 or later can access the domain name.
- TLS v1.1: Only requests using TLS v1.1 or later can access the domain name.
- TLS v1.2: Only requests using TLS v1.2 or later can access the domain name.
Click Confirm.

Verification

If the Minimum TLS Version is set to TLS v1.2, the website can be accessed over connections secured by TLS v1.2 or later, but cannot be accessed over connections secured by TLS v1.1 or earlier.

Parent Topic: Recommended Configurations After Website Connection

Previous topic: Recommended Configurations After Website Connection

Next topic: Enabling WAF IPv6 Protection