TLS configuration in Skapp
Overview
This document describes how encryption-in-transit is configured for Skapp's public endpoints — which TLS protocol versions and cipher suites we accept, and the reasoning behind those choices. The goal is a configuration that is strong by modern standards while remaining compatible with our real client base (browsers, the React Native mobile app, and customer/partner API integrations).
Where TLS terminates
All public Skapp hostnames are proxied through Cloudflare, which terminates public TLS at its edge:
app.skapp.com— web baseapp-api.skapp.comand other — REST and GraphQL APIs (browsers + React Native mobile + server-to-server callers)*.skapp.com— per-tenant subdomains (multi-tenant)
Because Cloudflare terminates TLS, the protocol/cipher posture below is configured at the Cloudflare zone level and automatically applies to every current and future *.skapp.com host — there is no per-service TLS configuration in the application itself.
Any static documents and images and other resource served via CloudFront/S3 presigned URLs terminate TLS at AWS (if they doesn't go under the same domain), not Cloudflare, and are governed by their own distribution settings (noted at the end).
TLS protocol posture
| Setting | Value | Rationale |
|---|---|---|
| Minimum TLS version | TLS 1.2 | TLS 1.0 and 1.1 are deprecated (RFC 8996) and carry known attacks (POODLE, BEAST). Enforcing a 1.2 floor closes the protocol-downgrade vector. |
| TLS 1.3 | Enabled | Negotiated automatically when the client supports it; faster handshake and AEAD-only. Falls back to 1.2 for clients that can't do 1.3. |
Skapp — TLS Changes in Cloudflare (Quick Reference)
All in the skapp.com zone → SSL/TLS → Edge Certificates.
| What | Where | Set to |
|---|---|---|
| Minimum TLS Version | SSL/TLS → Edge Certificates → Minimum TLS Version | TLS 1.2 |
| TLS 1.3 | SSL/TLS → Edge Certificates → TLS 1.3 | On |
That's it — two settings. Setting the minimum to 1.2 disables TLS 1.0/1.1 across all *.skapp.com hosts.
Not changed:
- Cipher suites — left on Cloudflare default (Advanced Certificate Manager not activated). A low-priority CBC suite is still offered on TLS 1.2; accepted, not removed.
- Encryption mode (Full strict) and Always Use HTTPS (On) — already correct, untouched.
- Path to navigate - SSL/TLS → Overview (in newer dashboards it's sometimes labelled SSL/TLS → Configuration).
Verify: SSL Labs (ssllabs.com/ssltest) on app.skapp.com → expect A+, protocols TLS 1.2/1.3 only.