Using WAF to Improve Connection Security

Application Scenarios

HTTPS is a network protocol constructed based on Transport Layer Security (TLS) and HTTP for encrypted transmission and identity authentication. When you add a domain name to WAF, set Client Protocol to HTTPS. Then, you can configure the minimum TLS version and cipher suite to harden website security. The details are as follows:

• Minimum TLS version

  The minimum TLS version that can be used by a client to access the website. After you configure the minimum TLS version, only the requests over the connections secured with the minimum TLS version or the later version can access your website. This helps you meet security requirements for industrial websites.

  

  • Up to now, three TLS versions (TLS v1.0, TLS v1.1, and TLS v1.2) have been released, among which TLS v1.0 and TLS v1.1 have been released for a long time. Some encryption algorithms (such as SHA1 and RC4) used by TLS v1.0 and TLS v1.1 are vulnerable to attacks. TLS v1.0 and TLS v1.1 cannot meet the geometric growth of data transmission encryption requirements, which might bring potential security risks. To secure the communication and meet the Payment Card Industry Data Security Standard (PCI DSS), PCI Security Standards Council (PCI SSC) stated that it no longer accepted TLS v1.0 as of June 30, 2018. Vendors of mainstream browsers, such as Mozilla Firefox, Apple Safari, Google Chrome, and Microsoft Edge, also declared that they would stop supporting TLS v1.0 and TLS v1.1 by 2020.
  • You can query the TLS version supported by the website through other tools.
• Cipher suites

  A cipher suite is a set of algorithms that help secure a network connection through TLS. A more secure cipher suite can better secure the confidentiality and data integrity of websites.

Resource and Cost Planning

Minimum TLS Versions Supported

The default minimum TLS version configured in WAF is TLS v1.0. To better secure your website, configure an appropriate TLS version. Table 2 lists the minimum TLS versions supported for different scenarios.

Cipher Suites Supported

The default cipher suite in WAF is Cipher suite 1. Cipher suite 1 offers a good mix of browser compatibility and security. For details about each cipher suite, see Table 3.

The cipher suites provided by WAF are compatible with the latest browsers and clients, but are incompatible with some browsers of earlier versions. Compatible browsers or clients of a certain cipher suite may vary depending on the TLS version configured. Using TLS v1.0 as an example, Table 4 describes the browser and client compatibility.

It is recommended that compatibility tests should be carried out on the service environment to ensure service stability.

Configuring the Minimum TLS Version and Cipher Suite

The following describes how to configure TLS v1.2 and cipher suite 1 as the minimum TLS version and how to verify that the configuration takes effect.

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner and choose Web Application Firewall under Security & Compliance.
4. In the navigation pane on the left, choose Website Settings.
5. In the Domain Name column, click the website domain name to go to the basic information page.
6. Click in the TLS Configuration row.
   Figure 1 TLS configuration modification
   
   

   WAF allows you to enable PCI DSS and PCI 3-Domain Secure (3DS) compliance certification checks with just a few clicks. After they are enabled, WAF will configure the minimum TLS version in accordance with the PCI DSS and PCI 3DS compliance certification requirements.

   • If you enable the PCI DSS certification check:
     • The minimum TLS version and cypher suite are automatically set to TLS v1.2 and EECDH+AESGCM:EDH+AESGCM, respectively, and cannot be changed.
     • To change the minimum TLS version and cipher suite, disable the check.
   • If you enable the PCI 3DS certification check:
     • The minimum TLS version is automatically set to TLS v1.2 and cannot be changed.
     • The check cannot be disabled.

7. In the displayed TLS Configuration dialog box, select TLS v1.2 as the minimum TLS version and Cipher suite 1.
   Figure 2 TLS Configuration
   

8. Click Confirm.

Verification

If the Minimum TLS Version is set to TLS v1.2, verify that the website can be accessed over connections secured by TLS v1.2 or later but cannot be accessed over connections secured by TLS v1.1 or earlier.

You can run commands on the local PC to check whether the TLS is configured successfully. Before the verification, ensure that OpenSSL has been installed on your local PC.

1. Copy the CNAME record of the protected domain name and use the CNAME record to obtain WAF access IP addresses.
   1. Log in to the management console.
   2. Click in the upper left corner of the management console and select a region or project.
   3. Click in the upper left corner and choose Web Application Firewall under Security & Compliance.
   4. In the navigation pane on the left, choose Website Settings.
   5. In the Domain Name column, click the domain name of the website to go to the basic information page.
   6. In the CNAME row, click to copy the CNAME record.
      Figure 3 Copying the CNAME record
      

2. Obtain the WAF access IP addresses.
   • Cloud mode

     In the command line interface (CLI) of Windows OSs, run the following command to obtain WAF access IP addresses:

     ping CNAME record

     The command output displays WAF access IP addresses. Figure 4 shows an example.

     Figure 4 ping cname
     
   • Dedicated mode
     1. In the navigation pane on the left, choose Instances Management > Dedicated Engine to go to the dedicated WAF instance page.
     2. In the IP Address column, obtain the subnet IP addresses of all dedicated WAF instances. Those subnet IP addresses are access IP addresses of dedicated WAF instances.

3. Run the following command to verify that the protected website can be accessed using TLS v1.2.

   openssl s_client -connect WAF access IP address -servername "Domain name of the protected website" -tls1_2

   If the certificate information similar to the one shown in Figure 5 is displayed, the website can be accessed using TLS v1.2.

   Figure 5 Verifying TLS v1.2
   

4. Run the following command to verify that the protected website cannot be accessed using TLS v1.1.

   openssl s_client -connect WAF access IP address -servername "Protected domain name" -tls1_1

   If no certificate information is displayed, as shown in Figure 6, WAF has blocked the access that used TLS v1.1.

   Figure 6 Verifying TLS v1.1