JA EN
shiichan

Keyless SSL now supports TLS 1.3 with ECDSA certificates

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security

Hi everyone, it's Shii-chan! This one is for folks who don't want to give up control of their private keys.

Cloudflare Changelog developers.cloudflare.com

What was announced?

The Cloudflare Changelog announced that Keyless SSL now supports TLS 1.3 for ECDSA certificates.

What changes

When TLS 1.3 is enabled on your zone, visitors connecting to a hostname that serves a Keyless ECDSA certificate negotiate TLS 1.3. Your private keys stay on your own key server.

Dive Deep

Here is the current picture.

  • Keyless SSL with ECDSA certificates: TLS 1.3 supported
  • Keyless SSL with RSA certificates: still negotiate up to TLS 1.2

So if you want TLS 1.3, ECDSA is the way to go. The Keyless SSL limitations page has the details.

Wrap-up

  • TLS 1.3 works with Keyless SSL ECDSA certificates
  • Private keys stay on your own key server
  • RSA certificates are limited to TLS 1.2

This one is for teams, such as in regulated industries, that can't let their keys leave their hands!

Related posts