Before the implementation procedure, let’s take a look at what is TLS 1.3, how it differs from 1.2, history, and compatibility.
What is TLS 1.3?
TLS (transport layer security) 1.3 is based on the existing 1.2 specifications. It’s the latest TLS version protocol and aims to improve performance and security. To learn more, refer to this post by Filippo. Let’s take a look at the history of the TLS protocol. TLS protocol can be enabled on Web Servers, CDN, Load Balancers, and network edge devices.
TLS 1.3 Browser Compatibility
1.3 is not supported in all the browsers yet. Currently, it works only with the latest version of Chrome, Firefox, Opera, and iOS Safari. If you are keen to implement as soon as it supports all the browsers, then bookmark this CanIUse page. Considering it is still at an early stage, you may want to enable 1.3 along with older version 1.2 and 1.1. Check out how to enable it in the browser. Here is TLS analytics for Geekflare. As you can see, more than 70% of requests over TLS 1.3.
Enable TLS 1.3 in Nginx
TLS 1.3 is supported starting from Nginx 1.13 version. If you are running the older version, then first, you got to upgrade. I assume you have Nginx 1.13+
Login to Nginx serverTake a backup of nginx.conf fileModify nginx.conf using vi or your favorite editor
The default configuration under SSL settings should look like this
Add TLSv1.3 at the end of the line, and so it looks like below
Note: above configuration will allow TLS 1/1.1/1.2/1.3. If you want to enable the secure one TLS 1.2/1.3, then your configuration should look like this.
Restart the Nginx
It’s easy. Isn’t it?
Enable TLS 1.3 in Apache
Starting from Apache HTTP 2.4.38, you can take advantage of TLS 1.3. If you are still using the older version, then you got to think of upgrading that first. The configuration is easy and similar to how you enable TLS 1.2 or 1.1 protocol. Let’s take a look…
Login to Apache HTTP server and take a backup or ssl.conf file or where you have SSL configurationLocate SSLProtocol line and add +TLSv1.3 at the end of the line
Ex: the following would allow TLS 1.2 and TLS 1.3
Save the file and restart Apache HTTP
Cloudflare
One of the first CDN providers to implement TLS 1.3 support. Cloudflare enables it by default for all the websites. However, if you need to disable or check, then here is how you can do it.
Login to CloudflareGo to SSL/TLS tab » Edge certificatesScroll down a bit, and you will see the TLS 1.3 option
What other Platform Support TLS 1.3?
I am aware of the following CDN.
CDN 77 – Recently, they have announced to support from some of their POP (point of presence).AKAMAI – AKAMAI has turned beta on network-wide.
How to Verify Site is Using TLS 1.3?
Once you’ve implemented through a web server or CDN, then next, you want to ensure your site is handshaking over TLS 1.3 protocol. There are multiple ways to test it. Geekflare TLS Test – quickly find out the supported TLS version. SSL Labs – enter your HTTPS URL and scroll down on the test result page. You will see what all protocols are enabled. Google Chrome – if you are enabling on intranet sites, then you can test it right from the Chrome browser.
Launch ChromeOpen Developer ToolsGo to the Security tabAccess HTTPS URLLeft side, select the main origin to see the protocol
And there you go! Considering TLS 1.3 is still new, you may implement it on your website but don’t forget to keep the older version-enabled. Having TLS 1.1, 1.2 enabled will ensure the client (browsers) can connect through other protocol versions if they are not compatible with 1.3 I hope this gives you an idea about implementing the latest TLS protocol to offer better website security.
