Skip to content

[Gateway] TLS version support #18056

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Nov 8, 2024
Merged

[Gateway] TLS version support #18056

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d139dae
Add version support
maxvp Nov 7, 2024
66f81f7
Reorder sections
maxvp Nov 7, 2024
5dbc75a
Add H3 requirements
maxvp Nov 7, 2024
e06ce91
Fix casing
maxvp Nov 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/content/docs/cloudflare-one/policies/gateway/http-policies/http3.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,12 @@
pcx_content_type: concept
title: HTTP/3
sidebar:
order: 2
order: 3
---

import { Details } from "~/components";

Gateway supports inspection of HTTP/3 traffic, which uses the QUIC protocol over UDP. HTTP/3 inspection requires traffic to be proxied over UDP.
Gateway supports inspection of HTTP/3 traffic, which uses the QUIC protocol over UDP. HTTP/3 inspection requires a [user-side certificate](/cloudflare-one/connections/connect-devices/warp/user-side-certificates/) to be deployed and traffic to be proxied over UDP with [TLS version 1.3](/cloudflare-one/policies/gateway/http-policies/tls-decryption/).

Gateway applies HTTP policies to HTTP/3 traffic last. For more information, refer to the [order of enforcement](/cloudflare-one/policies/gateway/order-of-enforcement/#http3-traffic).

Expand Down
10 changes: 6 additions & 4 deletions src/content/docs/cloudflare-one/policies/gateway/http-policies/tls-decryption.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
pcx_content_type: concept
title: TLS decryption
sidebar:
order: 3
order: 2
---

import {
Expand All @@ -19,6 +19,8 @@ When you enable TLS decryption, Gateway will decrypt all traffic sent over HTTPS

Cloudflare prevents interference by decrypting, inspecting, and re-encrypting HTTPS requests in its data centers in memory only. Gateway only stores eligible cache content at rest. All cache disks are encrypted at rest. You can configure where TLS decryption takes place with [Regional Services](/data-localization/regional-services/) in the [Cloudflare Data Localization Suite (DLS)](/data-localization/).

Cloudflare supports connections from users to Gateway over TLS 1.1, 1.2, and 1.3.

## Enable TLS decryption

<Render file="gateway/enable-tls-decryption" product="cloudflare-one" />
Expand Down Expand Up @@ -51,7 +53,7 @@ Google Chrome can automatically upgrade HTTP requests to HTTPS requests, even wh

You can turn off automatic HTTPS upgrades via a Gateway pass through policy, a Chrome browser flag, or a Chrome Enterprise policy.

<Tabs> <TabItem label="pass through policy">
<Tabs> <TabItem label="Pass through policy">

To disable automatic HTTPS upgrades for a URL across your Zero Trust organization, create a Gateway pass through policy.

Expand All @@ -69,11 +71,11 @@ To disable automatic HTTPS upgrades for a URL across your Zero Trust organizatio

The pass through policy will bypass insecure connection upgrades for any device connected to your Zero Trust organization. For more information, refer to [Untrusted certificates](/cloudflare-one/policies/gateway/http-policies/#untrusted-certificates).

</TabItem> <TabItem label="chrome browser flag">
</TabItem> <TabItem label="Chrome browser flag">

To disable automatic HTTPS upgrades on a per-browser basis, go to [Chrome flags](chrome://flags/#https-upgrades) and turn off **HTTPS Upgrades**.

</TabItem> <TabItem label="chrome enterprise policy">
</TabItem> <TabItem label="Chrome enterprise policy">

Chrome Enterprise users can turn off automatic HTTPS upgrades for all URLs with a [`HttpsUpgradesEnabled` management policy](https://chromeenterprise.google/policies/#HttpsUpgradesEnabled).

Expand Down
Loading