| pcx_content_type | reference | ||
|---|---|---|---|
| products |
|
||
| title | Browser compatibility | ||
| sidebar |
|
||
| head | |||
| description | Review information about browser compatibility for the different Cloudflare SSL/TLS offerings. |
Cloudflare attempts to provide compatibility for as wide a range of user agents (browsers, API clients, etc.) as possible. However, the specific set of supported clients can vary depending on the different SSL/TLS certificate types, your visitor's browser version, and the certificate authority (CA) that issues the certificate.
Cloudflare Universal SSL only supports browsers and API clients that use the Server Name Indication (SNI) extension to the TLS protocol.
Also, for zones on Free plan, Universal SSL is only compatible with browsers that support Elliptic Curve Digital Signature Algorithm (ECDSA).
Paid plans have additional compatibility, also supporting RSA algorithm.
Refer to Certificate authorities for a detailed list of Cloudflare SSL/TLS offerings, the different algorithms available, and browser compatibility for each CA.
Although SNI extensions to the TLS protocol were standardized in 2003, some browsers and operating systems only implemented this extension when TLS 1.1 was released in 2006 (or 2011 for mobile browsers). If your visitors use devices that have not been updated since 2011, they may not have SNI support.
To support non-SNI requests, you can:
-
Upload a custom certificate and specify a value of
Legacyfor its client support.Note that
Legacycustom certificates are not compatible with BYOIP and that, unlike Universal SSL or advanced certificates, Cloudflare does not manage issuance and renewal for custom certificates. -
(BYOIP customers only) Enterprise customers can choose to bring their own IP prefix to the Cloudflare network and specify the default SNI used for any non-SNI handshake in the address map.
-
(Paid plans only) Contact Cloudflare Support and request a set of non-SNI IPs for your zone.
HTTPS Service (HTTPS) records allow you to provide a client with information about how it should connect to a server upfront, without the need of an initial plaintext HTTP connection.
If your domain has HTTP/2 or HTTP/3 enabled, proxied DNS records, and is also using Universal SSL, Cloudflare automatically generates HTTPS records on the fly, to advertise to clients how they should connect to your server.
:::caution[Universal SSL required for automatic HTTPS records] Disabling Universal SSL will prevent automatic HTTPS record generation for proxied hostnames, even if you have Advanced Certificates or custom certificates configured. This is because automatic HTTPS record generation is tied specifically to the Universal SSL feature.
If you need HTTPS records without Universal SSL, you can manually add them, but only if all records with the same name are DNS-only (grey cloud). Refer to SVCB and HTTPS records for details and examples. :::
Cloudflare's OCSP implementation uses HTTP/1.1 by default for plain HTTP connections.
For HTTPS connections, the client automatically attempts to use HTTP/2 if the server supports it through the TLS ALPN (Application-Layer Protocol Negotiation) extension. If HTTP/2 is not available or supported by the server, it will fall back to HTTP/1.1.