导航|地址|刷新
3 – Configure HTTPS settings

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/terraform/llms.txt
Use this file to discover all available pages before exploring further.



DocsDirectoryAPISDKsChangelog

Search

Log in






Terraform

/




Overview

Get started


Tutorials


Overview

1 – Initialize Terraform

2 – Track your history

3 – Configure HTTPS settings

4 – Improve performance

5 – Add exceptions with Page Rules

6 – Revert configuration






Additional configurations


WAF Managed Rules

DDoS managed rulesets

Rate limiting rules

WAF custom rules

Transform Rules

Single Redirects ↗

Bulk Redirects ↗

Configuration Rules ↗

Origin Rules ↗

Cache Rules ↗

Snippets ↗

Workers ↗






How-to guides


Create a partial zone

Create a subdomain zone






Advanced topics


Best practices

Import Cloudflare resources

Provider customization

Remote R2 backend






Troubleshooting


Create DNS records error

Rule IDs change when making updates






Agent resources


Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

Terraform llms.txt ↗

Terraform llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗













Home

/Terraform

/Tutorials

/3 – Configure HTTPS settings



3 – Configure HTTPS settings


Last updated May 5, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewPrerequisites1. Create zone setting configuration2. Preview and apply the changes3. Verify the settings




After setting up basic DNS records, you can configure zone settings using Terraform. This tutorial shows how to enable TLS 1.3, Automatic HTTPS Rewrites, and Strict SSL mode using the updated v5 provider.


Prerequisites


Completed tutorials 1 and 2

Valid SSL certificate on your origin server (use the Cloudflare Origin CA to generate one for strict SSL mode)


Note


Terraform code snippets below refer to the v5 SDK only.




1. Create zone setting configuration


Create a new branch and add zone settings:
git checkout -b step3-zone-settings
Add the following to your main.tf file:
# Enable TLS 1.3resource "cloudflare_zone_setting" "tls_1_3" { zone_id = var.zone_id setting_id = "tls_1_3" value = "on"}# Enable automatic HTTPS rewritesresource "cloudflare_zone_setting" "automatic_https_rewrites" { zone_id = var.zone_id setting_id = "automatic_https_rewrites" value = "on"}# Set SSL mode to strictresource "cloudflare_zone_setting" "ssl" { zone_id = var.zone_id setting_id = "ssl" value = "strict"}

2. Preview and apply the changes


Review the proposed changes:
terraform plan
Expected output
Plan: 3 to add, 0 to change, 0 to destroy.Terraform will perform the following actions: # cloudflare_zone_setting.automatic_https_rewrites will be created + resource "cloudflare_zone_setting" "automatic_https_rewrites" { + setting_id = "automatic_https_rewrites" + value = "on" + zone_id = "your-zone-id" } # cloudflare_zone_setting.ssl will be created + resource "cloudflare_zone_setting" "ssl" { + setting_id = "ssl" + value = "strict" + zone_id = "your-zone-id" } # cloudflare_zone_setting.tls_1_3 will be created + resource "cloudflare_zone_setting" "tls_1_3" { + setting_id = "tls_1_3" + value = "on" + zone_id = "your-zone-id" }
Commit and merge the changes:
git add main.tfgit commit -m "Step 3 - Enable TLS 1.3, automatic HTTPS rewrites, and strict SSL"git checkout maingit merge step3-zone-settingsgit push
Before applying the changes, try to connect with TLS 1.3. Technically, you should not be able to with default settings. To follow along with this test, you will need to compile curl against BoringSSL ↗.
curl -v --tlsv1.3 https://www.example.com 2>&1 | grep "SSL connection\|error"
As shown above, you should receive an error because TLS 1.3 is not yet enabled on your zone. Enable it by running terraform apply and try again.

Apply the configuration:
terraform apply
Type yes when prompted.


3. Verify the settings


Try the same command as before. The command will now succeed.
curl -v --tlsv1.3 https://www.example.com 2>&1 | grep "SSL connection\|error"

Previous2 – Track your historyNext4 – Improve performance


Was this helpful?

YesNo

Edit pageReport issue




On this page

Overview

Prerequisites

1. Create zone setting configuration

2. Preview and apply the changes

3. Verify the settings


Edit pageReport issue














Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search


Company
AboutCareersInvestorsPressPress kitGlobal network




Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG


Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse




Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog


Developers
DocumentationLearning centerCommunity




Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform


Start BuildingLog In












© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices








Docs




------
导航页 打开网址