TLS configuration in Skapp

Type: Explanation·Created: ·Team: Security

draft

Overview

This document describes how encryption-in-transit is configured for Skapp's public endpoints — which TLS protocol versions and cipher suites we accept, and the reasoning behind those choices. The goal is a configuration that is strong by modern standards while remaining compatible with our real client base (browsers, the React Native mobile app, and customer/partner API integrations).

Where TLS terminates

All public Skapp hostnames are proxied through Cloudflare, which terminates public TLS at its edge:

• app.skapp.com — web base
• app-api.skapp.com and other — REST and GraphQL APIs (browsers + React Native mobile + server-to-server callers)
• *.skapp.com — per-tenant subdomains (multi-tenant)

Because Cloudflare terminates TLS, the protocol/cipher posture below is configured at the Cloudflare zone level and automatically applies to every current and future *.skapp.com host — there is no per-service TLS configuration in the application itself.

Any static documents and images and other resource served via CloudFront/S3 presigned URLs terminate TLS at AWS (if they doesn't go under the same domain), not Cloudflare, and are governed by their own distribution settings (noted at the end).

TLS protocol posture

Setting	Value	Rationale
Minimum TLS version	TLS 1.2	TLS 1.0 and 1.1 are deprecated (RFC 8996) and carry known attacks (POODLE, BEAST). Enforcing a 1.2 floor closes the protocol-downgrade vector.
TLS 1.3	Enabled	Negotiated automatically when the client supports it; faster handshake and AEAD-only. Falls back to 1.2 for clients that can't do 1.3.

How we have configured TLS in cloudflare

Where everything lives

All settings are at the Cloudflare zone level for skapp.com. Because TLS terminates at the Cloudflare edge, there is no application-side TLS configuration for public traffic. Settings apply zone-wide to every proxied (orange-cloud) *.skapp.com host, including future tenant subdomains.

Dashboard path for everything below: Cloudflare → skapp.com zone → SSL/TLS.

Prerequisites that must remain true

These underpin the whole posture; don't disable them:

Setting	Location	Required value
SSL/TLS encryption mode	SSL/TLS → Overview	Full (strict)
Always Use HTTPS	SSL/TLS → Edge Certificates	On