SSL/TLS Configuration

Overview

CloudNexus enforces strong cryptographic defaults across all edge nodes and origin servers. TLS termination occurs at the global edge, ensuring minimal latency and maximum security. You can customize cipher suites, enforce protocol versions, and manage certificates via the API, CLI, or infrastructure-as-code templates.

Supported Protocols

Only modern, vetted TLS versions are enabled by default. Older protocols (SSLv2, SSLv3, TLS 1.0, TLS 1.1) are permanently disabled and cannot be enabled due to known cryptographic vulnerabilities.

Default Cipher Suites

CloudNexus uses a curated cipher suite order prioritizing forward secrecy, AEAD encryption, and hardware acceleration. Custom cipher lists are supported via configuration overrides.

TLS 1.3

TLS 1.2 (Fallback)

Certificate Management

Automate certificate provisioning, renewal, and validation across all edge locations.

ACME v2 Automation

CloudNexus integrates natively with Let's Encrypt and ZeroSSL via ACME v2. Enable auto-provisioning to receive valid certificates for any domain pointing to your infrastructure.

Custom Certificates

Upload your own CA-signed or enterprise certificates in PEM or PKCS#12 format. Wildcard and SAN certificates are fully supported.

Configuration Examples

Define TLS behavior via API, CLI, or infrastructure-as-code. Choose your preferred format:

# Enforce TLS 1.2+ and set custom cipher order
cloudnexus tls configure \
  --protocol-min tls12 \
  --ciphers "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384" \
  --hsts true \
  --hsts-max-age 31536000

# Enable ACME auto-provisioning for a domain
cloudnexus cert provision \
  --domain app.example.com \
  --provider letsencrypt \
  --challenge http-01

Content-Type: application/json
Authorization: Bearer <token>

{
  "protocol_minimum": "TLSv1.2",
  "cipher_suite_mode": "custom",
  "cipher_order": [
    "TLS_AES_256_GCM_SHA384",
    "TLS_CHACHA20_POLY1305_SHA256",
    "ECDHE-ECDSA-AES256-GCM-SHA384"
  ],
  "http_strict_transport_security": {
    "enabled": true,
    "max_age": 31536000,
    "include_subdomains": true
  },
  "ocsp_stapling": true
}

tls:
  minimum_version: TLSv1.2
  cipher_suites:
    mode: recommended
    override: []
  hsts:
    enabled: true
    max_age_seconds: 31536000
    preload: false
  certificates:
    auto_renew: true
    provider: acme
    challenge_type: http

Security Headers

CloudNexus automatically injects modern security headers when TLS is enabled. You can customize or disable them per endpoint.

Testing & Validation

Verify your TLS configuration using built-in diagnostics or external validators.

Internal Validation Endpoint

Run a quick cryptographic audit against your edge node:

cloudnexus tls audit --domain app.example.com --verbose
# Returns JSON report with cipher compatibility, HSTS status, and CT logging

External Validators

• SSL Labs Server Test (Target score: A+)
• BrowserLeaks SSL Checker
• Certificate Transparency Search

Troubleshooting

Common Issues