Is locking TLS on the origin enough?

No. Users handshake with the CDN (or other edge). Set min TLS there, and still lock origin so a bypass is not a time machine.

Does RoastMyOpsec check TLS 1.0 at the CDN?

No. The free TLS check is scheme and certificate trust on the URL you submit, not a version or cipher scan.

Should we disable TLS 1.2?

Not by default in 2026. Prefer 1.3 and keep 1.2 until you know the clients. Disable 1.0 and 1.1 at the public edge.

Safety

Min TLS Version at the CDN vs the Origin

September 6, 2024

Min TLS version at the CDN vs the origin is which handshake the public internet actually sees: visitors terminate TLS on the edge, so origin-only 1.2+ never helps if the CDN still offers 1.0, and a bypassed origin IP still speaks whatever you left on the origin. Prefer TLS 1.3, keep 1.2 until old clients are gone, and turn 1.0/1.1 off at the hostname people type. RoastMyOpsec's free TLS check is HTTPS scheme and trust-store acceptance on the URL you paste — it does not negotiate min version, compare CDN to origin, or score missing TLS 1.3 as an F.

The practical difference

CDN min TLS is the product most users hit. Origin min TLS is the origin-pull and any direct-to-origin path (forgotten A records, staging hostnames, mail-admin panels on the same IP). Align both, then keep origin off public DNS if the CDN is supposed to be the only front door.

HSTS and a 301 to HTTPS still matter more for OPSEC than winning a cipher screenshot. A valid certificate on the name you advertise is the roast's TLS evidence. Mixed content and cookie Secure flags are separate findings.

How to choose based on what you shipped

Set the CDN (or load balancer) to TLS 1.2 minimum, enable 1.3, drop 1.0/1.1. Match origin pull so the CDN is not the only grown-up in the path. Government and many enterprise baselines treat 1.2 as the floor; 1.3 is the generation to offer.

Do not disable TLS 1.2 on the edge the week a payment iframe or old WebView still needs it. Do not assume a homepage roast proved origin-only hostnames.

Option	When it wins	Watch-out	Takeaway
Min TLS 1.2+ at the CDN	Public visitors; the hostname in ads and sitemaps	Origin still on 1.0 via a leaked IP	The control users actually negotiate
Min TLS 1.2+ at origin	Origin pull and any direct hostname you still publish	Hardening origin while the CDN still offers 1.0	Necessary, not sufficient, if the edge is public
TLS 1.3 enabled	Modern clients; fewer handshake round trips	1.3-only while a partner still needs 1.2	Offer it; do not make it a roast requirement
HTTPS URL + trusted cert	This visit works	Treating it as a Qualys cipher audit	What the free roast actually checks

When origin TLS still wins the argument

Origin TLS still wins when employees, cron jobs, or a support vendor hit the origin hostname, or when a cached DNS answer bypasses the CDN. CDN TLS still wins for the campaign URL. You want both floors, plus HSTS on the public name.

A URL roast of https://www.example.com is an edge story. It will not SSH to origin or enumerate ciphers. Pair with HSTS vs redirect and do not expose origin IPs in public DNS if that is the design.

Common mistakes

The first mistake is TLS 1.2-only on origin and TLS 1.0 still on the CDN 'for old browsers.'

The second mistake is publishing the origin A record next to the CDN CNAME.

The third mistake is reading a RoastMyOpsec TLS pass as a min-version certificate.

What a URL roast can prove

RoastMyOpsec confirms the audited URL is HTTPS (or redirects to HTTPS) and that the runtime trust store accepts the certificate. It does not set or read a min TLS version at CDN or origin, does not list ciphers, and does not score TLS 1.3 as required. HSTS is a separate header check (missing or short max-age). The scan does not submit HSTS preload, does not score GPC, and does not run protocol-downgrade exploits. Align edge and origin in your provider consoles, then re-scan the public hostname.

Free audit the URL you own

RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.

Free audit now

FAQ

Is locking TLS on the origin enough?: No. Users handshake with the CDN (or other edge). Set min TLS there, and still lock origin so a bypass is not a time machine.
Does RoastMyOpsec check TLS 1.0 at the CDN?: No. The free TLS check is scheme and certificate trust on the URL you submit, not a version or cipher scan.
Should we disable TLS 1.2?: Not by default in 2026. Prefer 1.3 and keep 1.2 until you know the clients. Disable 1.0 and 1.1 at the public edge.