[SSL] expand PCI DSS compliance guide - #33160
Conversation
github-actions
Bot
added
product:ssl
|
This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:
|
ngayerie
changed the title
|
Preview URL: https://9c6aefa5.preview.developers.cloudflare.com Files with changes (up to 15)
|
Review
👉 Fix in your agent 👈Fix the following review findings in PR #33160 (https://github.com/cloudflare/cloudflare-docs/pull/33160).
Before making changes, review each finding and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g. the fix requires disproportionate effort for minimal benefit,
or the finding is factually incorrect), explain why
- If you need clarification before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order
After triaging, follow this order:
1. Post a comment on this PR for any findings you are skipping, with the finding ID and your reasoning.
2. Then commit the fixes for the legitimate findings.
The comment must come before the commit — the bot reads PR comments when a new
push triggers a review, so skip comments posted after the push will be missed.
---
## Style Guide Review
### Warnings (2)
#### SG-d324f00840c8 · Deprecated jargon: enable/disable (for toggles)
- **File:** `src/content/docs/ssl/reference/compliance-and-vulnerabilities.mdx` line 93
- **Issue:** Line 93 adds `2. Enable **TLS 1.3**.` — TLS 1.3 is a dashboard toggle
- **Fix:** Use `Turn on TLS 1.3` instead of `Enable TLS 1.3`
#### SG-acfc7105e3cb · Deprecated jargon: enable/disable (for toggles)
- **File:** `src/content/docs/ssl/reference/compliance-and-vulnerabilities.mdx` line 61
- **Issue:** Line 61 adds `When you [enable TLS 1.3](...)` — TLS 1.3 is a dashboard toggle
- **Fix:** Use `turn on TLS 1.3` instead of `enable TLS 1.3`
### Suggestions (3)
#### SG-4ebca7c5973d · Consolidate repeated admonitions
- **File:** `src/content/docs/ssl/reference/compliance-and-vulnerabilities.mdx` line 60
- **Issue:** Lines 56–63 add two `:::note` admonitions in the same Step 2 section
- **Fix:** Consolidate the two notes into one or integrate the content into prose
#### SG-3a5f55dae80a · Bullet list with fewer than three items
- **File:** `src/content/docs/ssl/reference/compliance-and-vulnerabilities.mdx` line 105
- **Issue:** Lines 105–106 add a bullet list with only two items (SSL Labs and SSL Shopper)
- **Fix:** Consider writing the two options as prose instead of a bullet list
#### SG-5700f0c068ea · Bullet list with fewer than three items
- **File:** `src/content/docs/ssl/reference/compliance-and-vulnerabilities.mdx` line 191
- **Issue:** Lines 191–192 add a bullet list with only two items
- **Fix:** Consider writing the two items as prose instead of a bullet list
Code ReviewThis code review is in beta and may not always be helpful — use your judgment. No code review issues found. ConventionsNo convention issues found. Style Guide ReviewWarnings (2)
Suggestions (3)
CommandsOnly codeowners can run commands. Post a comment with the command to trigger it.
|
|
Skipping CR-31043405b1be (Incorrect technical claim about certificate redeployment). The claim that "Updating cipher suites triggers certificate redeployment" is not an error introduced by this PR — it is sourced verbatim from the existing |
40e0d35 to
be54822
Compare
|
I think the rebase (be54822) may have dropped the pci-dss.mdx changes — not seeing that file in the current diff, but the description and @zeinjaber's approvals reference it. Could you check? |
| A vulnerability in the use of the Triple DES (3DES) encryption algorithm in the Transport Layer Security (TLS) protocol. Sweet32 is currently a proof of concept attack, there are no known examples of this in the wild. Cloudflare has manually mitigated the vulnerability for TLS 1.0 in the following manner: | ||
| If a scanner flags Sweet32, verify that TLS 1.0 is disabled on your zone. Refer to [Set minimum TLS version to 1.2](#step-1-set-minimum-tls-version-to-12) for steps. With TLS 1.0 disabled, the 3DES cipher suites where Sweet32 applies are not in use and the finding does not apply to your environment. | ||
|
|
||
| ### `_cfuvid` cookie missing Secure flag |
There was a problem hiding this comment.
I couldn't find a source for the '_cfuvid flagged for missing Secure flag' false positive. Could you link one, or maybe soften the claim if there isn't one?
| Keep the WAF exception as narrow as possible — scoped to the scanner's IP range only. Remove it as soon as scanning is complete. | ||
| ::: | ||
|
|
||
| Cloudflare's WAF may block attack-pattern traffic used by ASV scanners. If scanning is impacted, work with your ASV and QSA to determine the appropriate exception handling. |
There was a problem hiding this comment.
I think this section repeats itself — the opening line and the one after :::caution both say the WAF blocks ASV scanner traffic. Might be worth trimming one.
|
|
||
| ### TCP source port behavior | ||
|
|
||
| Some ASV tools report a **TCP Source Port Pass Firewall** finding against Cloudflare-proxied IP addresses. This is a false positive caused by how source port selection works in Cloudflare's reverse proxy infrastructure, not a vulnerability in your environment. |
There was a problem hiding this comment.
Not blocking, but I believe the real mechanism is DNS source port 53 + NOTRACK, not general 'source port selection.' Up to you if you want more precision here.
| | Requirement | Description | Cloudflare feature | | ||
| | --- | --- | --- | | ||
| | **6.4.3** | Maintain an inventory of all scripts on payment pages, with authorization and integrity checks | Client-Side Security Advanced | | ||
| | **11.6.1** | Detect and alert on unauthorized changes to HTTP security headers and payment page content | Client-Side Security Advanced | |
There was a problem hiding this comment.
I think Cloudflare's PCI mapping doc attributes this to Page Shield, not Client-Side Security Advanced. Probably the same thing under current branding, but might be worth a quick check.
|
[AI] To address Bryan's note and Zein's inline threads on The Zein's inline comments on |
baubuchon-cf
left a comment
baubuchon-cf
left a comment
There was a problem hiding this comment.
LGTM
Verified against published docs and internal wiki. Core PCI compliance guidance is correct.
Approved.
DEE-3623
8e8db75 to
9c6aefa
Compare
6 participants
Expands the SSL/TLS PCI DSS compliance documentation to address a gap identified in the SSL/TLS Clarity Report (theme 11).
DEE-3623
Changes
/ssl/reference/compliance-and-vulnerabilities/: rewritten as a complete how-to guide covering minimum TLS 1.2, PCI DSS cipher suite profile, TLS 1.3 (recommended), configuration verification, Cloudflare Pages limitation, PCI DSS v4 client-side requirements summary, ASV scan behaviour, and known scanner false positivesNote: the
/client-side-security/reference/pci-dss/changes were split to a separate PR (#33199) which was closed pending legal review of the requirements mapping. That scope is not included here.