Configuring the Minimum TLS Version and Cipher Suite to Better Secure Connections

Recommended Minimum TLS Versions for Different Scenarios

To better secure your website, configure an appropriate TLS version. Table 1 lists the recommended minimum TLS versions for different scenarios.

Recommended Cipher Suites

The default cipher suite in WAF is Cipher suite 1. Cipher suite 1 offers a good mix of browser compatibility and security. For details about each cipher suite, see Table 2.

The cipher suites whose configuration value starts with ! are not supported. For example, !MD5 indicates that the MD5 algorithm is not supported.

The cipher suites provided by WAF are compatible with the latest browsers and clients, but are incompatible with some browsers of earlier versions. Compatible browsers or clients of a certain cipher suite may vary depending on the TLS version configured. Using TLS v1.0 as an example, Table 3 describes the browser and client compatibility.

It is recommended that compatibility tests should be carried out on the service environment to ensure service stability.

Configuring the Minimum TLS Version and Cipher Suite

The following describes how to configure TLS v1.2 and cipher suite 1 as the minimum TLS version and how to verify that the configuration takes effect for dedicated WAF instances.

1. Log in to the management console.
2. Click in the upper left corner of the management console and select a region or project.
3. Click in the upper left corner and choose Web Application Firewall (Dedicated) under Security.
4. In the navigation pane on the left, choose Website Settings.
5. In the Domain Name column, click the website domain name to go to the basic information page.
6. Click in the TLS Configuration row.
   

   WAF allows you to enable PCI DSS and PCI 3-Domain Secure (3DS) compliance certification checks with just a few clicks. After they are enabled, WAF will configure the minimum TLS version in accordance with the PCI DSS and PCI 3DS compliance certification requirements.

   • If you enable the PCI DSS certification check:
     • The minimum TLS version and cypher suite are automatically set to TLS v1.2 and EECDH+AESGCM:EDH+AESGCM, respectively, and cannot be changed.
     • To change the minimum TLS version and cipher suite, disable the check.
   • If you enable the PCI 3DS certification check:
     • The minimum TLS version is automatically set to TLS v1.2 and cannot be changed.
     • The check cannot be disabled.

7. In the displayed TLS Configuration dialog box, select TLS v1.2 as the minimum TLS version and Cipher suite 1.
8. Click Confirm.

Verification

If the Minimum TLS Version is set to TLS v1.2, verify that the website can be accessed over connections secured by TLS v1.2 or later but cannot be accessed over connections secured by TLS v1.1 or earlier.

You can run commands on the local PC to check whether the TLS is configured successfully. Before the verification, ensure that OpenSSL has been installed on your local PC.

1. Copy the CNAME record of the protected domain name and use the CNAME record to obtain WAF back-to-source IP addresses.
   1. Log in to the management console.
   2. Click in the upper left corner of the management console and select a region or project.
   3. Click in the upper left corner and choose Web Application Firewall (Dedicated) under Security.
   4. In the navigation pane on the left, choose Website Settings.
   5. In the Domain Name column, click the domain name of the website to go to the basic information page.
   6. In the CNAME row, click to copy the CNAME record.

2. Obtain the WAF back-to-source IP addresses.
   • Cloud mode

     In the command line interface (CLI) of the Windows OS, run the following command to obtain WAF back-to-source IP addresses:

     ping CNAME record

     The command output displays WAF back-to-source IP addresses. Figure 1 shows an example.

     Figure 1 ping cname
     
   • Dedicated mode
     1. In the navigation pane on the left, choose Instances Management > Dedicated Engine to go to the dedicated WAF instance page.
     2. In the IP Address column, obtain the subnet IP addresses of all dedicated WAF instances. Those subnet IP addresses are back-to-source IP addresses of dedicated WAF instances.

3. Run the following command to verify that the protected website can be accessed using TLS v1.2.

   openssl s_client -connect WAF back-to-source IP address -servername "Domain name of the protected website" -tls1_2

   If the certificate information similar to the one shown in Figure 2 is displayed, the website can be accessed using TLS v1.2.

   Figure 2 Verifying TLS v1.2
   

4. Run the following command to verify that the protected website cannot be accessed using TLS v1.1.

   openssl s_client -connect WAF back-to-source IP address -servername "Protected domain name" -tls1_1

   If no certificate information is displayed, as shown in Figure 3, WAF has blocked the access that used TLS v1.1.

   Figure 3 Verifying TLS v1.1