> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/product-guides/web-ddos/interface/instances/tls-settings.md).

# TLS Settings

TLS (Transport Layer Security) is an encryption protocol used in conjunction with certificates in the [X.509](https://en.wikipedia.org/wiki/X.509) standard. It ensures secure communication between a server and client by encrypting the traffic in transit between the two parties. 

Link11 recommends that customers upload Certificates and Keys from trusted Certificate Authorities to get the most out of the Web DDoS service.

***

## **TLS**

Enables TLS for the instance. Encryption certificates will have to be uploaded.

<figure><img src="/files/XeBJyoOvRAPwvwumLwr4" alt=""><figcaption></figcaption></figure>

***

## **TLS Passthrough**

TLS Passthrough lets traffic passthrough the WebDDoS instance to the origin without decrypting content. This hinders Layer 7 protection, because the content cannot be checked by filters.

{% hint style="danger" %}
For [Zero Touch WAF](/product-guides/zero-touch-waf/introduction.md) and/or [Bot Management](/product-guides/bot-management/introduction.md) to be used, TLS Passthrough must be **disabled**.
{% endhint %}

When using TLS Passthrough, customers can still receive protection from the Network DDoS service. The following Web DDoS algorithms will also still work: [Unique IPs](/product-guides/web-ddos/interface/dashboard.md#id-webddos-dashboard-uniqueips) and [5xx Error Monitoring](/product-guides/web-ddos/interface/dashboard.md#server-error-5xx). Furthermore [Geo Blocking](/product-guides/web-ddos/interface/geo-blocking.md) and [ASN Blocking](/product-guides/web-ddos/interface/asn-blocking.md) can be enabled.

<figure><img src="/files/yg4JTHquIViwUKvVIkNU" alt=""><figcaption></figcaption></figure>

***

## **Enable Auto-Renewal TLS Certificate**

When enabled, TLS certificates can be auto-renewed via the Let’s Encrypt service.

{% hint style="info" %}
Auto-renewal is only available if [Secure DNS](/product-guides/secure-dns/introduction.md) was purchased.&#x20;
{% endhint %}

<figure><img src="/files/MdwAuNnUUau5KTh0uCQD" alt=""><figcaption></figcaption></figure>

***

## **TLS Certificate, Key & Chain**

{% hint style="danger" %}
**Note:**

Make sure to **correctly** paste your certificate , it should be complete and have the correct format. (It starts with **-----START CERTIFICATE-----** and ends with **-----END CERTIFICATE-----** )
{% endhint %}

The TLS Certificate and private key have to be uploaded here. Intermediate Certificates also belong here.

<figure><img src="/files/DmAas4Jr5ati2OyEM0Ej" alt=""><figcaption></figcaption></figure>

***

## **TLS Verify Client**

This enables Client Verification for the instance.&#x20;

Client Verification will confirm that clients (browsers) are allowed access to the instance by comparing the CA certificate uploaded in the Link11 platform to the client certificates in the browsers of the clients.

<figure><img src="/files/DI4iqSW37YCmWrxkmql8" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
If client verification is enabled, the [http to https redirect](#redirect-http-to-https) option should be activated. Otherwise, client verification could easily be circumvented by using http.
{% endhint %}

If client verification is enabled, the following three windows will appear:

## **TLS Client Certificate**

\[Only available when TLS Verify Client is enabled.] Upload the CA certificate here for client side verification.

<figure><img src="/files/ApNoulmnQ9zqZOGmhxKg" alt=""><figcaption></figcaption></figure>

## **TLS Client Certificate Revocation**

\[Only available when TLS Verify Client is enabled.] Defines Revocation of Serial Keys with an expiry date for TLS Client Certificates.

<figure><img src="/files/X0G7wQo0J4i32TI84EXy" alt=""><figcaption></figcaption></figure>

This setting is optional and can be used to revoke access for specific certificates that are installed in browsers.

## **TLS Client Verify Action**

\[Only available when TLS Verify Client is enabled.] Defines the action that should be taken when client certificates do not match the uploaded CA certificate.

<figure><img src="/files/8fyJ4noscoevBM8wvze9" alt=""><figcaption></figcaption></figure>

The Block Action is the default action; it will drop all connections at the Link11 proxies if they originate from a client that either does not have a client certificate or has a client certificate that does not match the CA or has been added to the revocation list. This behavior is applied instance-wide and cannot be limited to specific paths.

The Allow Action will allow all requests through to the origin regardless of whether they have a matching CA or not. It will append the client certificate as a header for requests coming from clients that have matching certificates that have not been revoked.

***

## **Use TLS to Origin for incoming TLS clients**

If this is not enabled, TLS connections will be decrypted and forwarded via HTTP (TLS offloading). Enabling this option will forward traffic over new TLS connections.

<figure><img src="/files/s1CDomGQOooWaDG71KbO" alt=""><figcaption></figcaption></figure>

***

## **Disable TLS Certificate Checking**

If this option is enabled, certificates will not be verified by the backend, and all certificates will be accepted as valid.

<figure><img src="/files/5SyNt5WPcxxgggaXgNkK" alt=""><figcaption></figcaption></figure>

***

## **Minimum TLS Protocol Support**

Sets the minimum TLS protocol version that will be accepted for the customer's website.

<figure><img src="/files/Nn8pLfEiU1erir5sfh4Z" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
Link11 recommends TLS 1.1, because older version will no longer receive security updates.
{% endhint %}

***

## **TLS Security Ciphers Configuration**

Selects an encryption algorithm that is used by the DDoS instance. The standard uses a recommended selection of ciphers which balances security and client availability.

<figure><img src="/files/E3XQvx8jcotlKbNs2bN1" alt=""><figcaption></figcaption></figure>

***

## **Advanced TLS Ciphers Configuration**

Accepts colon-separated strings of OpenSSL ciphers.

<figure><img src="/files/rH14RNaVK6g4C4oe8wPJ" alt=""><figcaption></figcaption></figure>

***

## **TLS Security Elliptic Curves Configuration**

Lets admins select the elliptic curves used by the DDoS Proxy Instance for ECDHE and ECDSA ciphers. The standard is recommended. Clients which do not support one of the supported curves will not be able to connect to the DDoS instance.

<figure><img src="/files/5yPmsdaMdi86qznFcrel" alt=""><figcaption></figcaption></figure>

If set to Advanced, this option will open the following window:

***

## **Advanced TLS Elliptic Curves Configuration**

\[Only available when TLS Security Elliptic Curves Configuration is set to Advanced.] Enter a “:” separated string of supported OpenSSL elliptic curves.

<figure><img src="/files/mv8KQXm86c052MpkX9rg" alt=""><figcaption></figcaption></figure>

***

## **Redirect HTTP to HTTPS**

Redirects insecure HTTP requests to secure HTTPS.&#x20;

{% hint style="info" %}
When [TLS Verify Client](#tls-verify-client) has been selected, this setting should be enabled. Otherwise client verification can be easily circumvented.\
\
Also, if you enable redirection, and you are using Secure CDN, be sure to enable redirection within the CDN as well: [Secure CDN / Instances / Edit Instance / Redirect HTTP to HTTPS](/product-guides/secure-cdn/interface/instances.md#redirect-http-to-https).&#x20;
{% endhint %}

<figure><img src="/files/0VcTVQNNKwijL8RV5riO" alt=""><figcaption></figcaption></figure>

***

## **Force redirection with 301 status code**

By default, HTTP is redirected to HTTPS with a HTTP 301 status code for http/1.0 connections, and with HTTP 307 status code for http/1.1 connections.&#x20;

With this option enabled, the status code will always be 301.

<figure><img src="/files/8Un79MDY4X5abDaftRkZ" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
**HTTP status code 301: Moved Permanently**\
Request was moved permanently, and the response contains the URI for the new location

**HTTP status code 307: Temporary Redirect**\
Request temporarily found a different URI, which is given in the response
{% endhint %}