Use CIS proxies for all DNS records for HTTP traffic from your origin

To improve the security of your origin IP address, you must proxy all HTTP and HTTPS traffic.

See the difference by querying a non-proxied and a proxied record:

dig nonproxied.theburritobot.com +short
1.2.3.4 (The origin IP address)

$ dig proxied.theburritobot.com +short
104.16.22.6 , 104.16.23.6 (CIS IP addresses)

Obscure non-proxied origin records with non-standard names

Any records that can't be proxied through CIS, and that still use your origin IP, such as FTP, can be secured by creating additional obfuscation. In particular, if you require a record for your origin that can't be proxied by CIS, use a non-standard name. For example, instead of ftp.example.com use [random word or-random characters].example.com. This obfuscation makes dictionary scans of your DNS records less likely to expose your origin IP addresses.

Use separate IP ranges for HTTP and non-HTTP traffic if possible

Some customers use separate IP ranges for HTTP and non-HTTP traffic. This approach helps them proxy all records for their HTTP IP range, and hide all non-HTTP traffic with a different IP subnet.

Increase the security level for sensitive areas to 'High'

You can increase this level in the Advanced Security page for your domain, or by adding a Page Rule for admin or login pages to reduce brute-force attempts:

1. Create a Page Rule with the URL pattern of your API (for example, www.example.com/wp-login).
2. Identify the Security Level setting.
3. Mark the setting as High.
4. Select Provision Resource.

Decrease the security level for non-sensitive paths or APIs to reduce false positives

You can decrease this level for general pages and API traffic:

1. Create a Page Rule with the URL pattern of your API (for example, www.example.com/api/*).
2. Identify the Security Level setting.
3. Turn the Security Level to Low or Essentially off.
4. Select Provision Resource.

What do the security level settings mean?

Our security level settings are aligned with threat scores that certain IP addresses acquire from malicious behavior on our network. A threat score greater than 10 is considered high.

• High: Threat scores greater than 0 are challenged.
• Medium: Threat scores greater than 14 are challenged.
• Low: Threat scores greater than 24 are challenged.
• Essentially off: Threat scores greater than 49 are challenged.
• Off: Enterprise only
• Defense mode: This level must be used only when your website is under a DDoS attack. Visitors receive an interstitial page for about five seconds while CIS analyzes the traffic and behavior to make sure that it is a legitimate visitor who is trying to access your website. Defense mode might affect some actions on your domain, such as using an API. You can set a custom security level for your API or any other part of your domain by creating a page rule for that section.

Consider reviewing your security-level settings periodically. You can find instructions in Best practices for CIS setup.

Upload custom certificates

You can upload your custom certificate by clicking Add Certificate and entering your certificate, private key, and bundle method. After you upload the custom certificate, you gain immediate compatibility with encrypted traffic, and you maintain control over your certificate (for example, an Extended Validation (EV) certificate). CIS does not support certificate pinning through ordered or Universal certificates. If you want to use certificate pinning, it is recommended that you upload and maintain your own custom certificate.

You are responsible for managing your certificate if you upload a custom certificate. For example, CIS doesn't track the certificate expiration date.

Order dedicated certificates

CIS makes managing your certificates simple by offering dedicated certificates. You no longer need to generate private keys, create certificate signing requests (CSR), or remember to renew certificates. You can order a dedicated certificate by clicking Add Certificate and ordering a wildcard certificate or entering hostnames to order a dedicated custom certificate. The types of certificates are:

• SHA-2/ECDSA signed certificate that uses P-256 key,
• SHA-2/RSA signed certificate that uses RSA 2048-bit key, and
• SHA-1/RSA signed certificate that uses RSA 2048-bit key.

CIS can issue certificates for all top-level domains (TLDs) except for the following ones:

• .cu (Cuba)
• .iq (Iraq)
• .ir (Iran)
• .kp (North Korea)
• .sd (Sudan)
• .ss (South Sudan)
• .ye (Yemen)

CIS manages the certificate expiration date. To edit the hostnames on your dedicated custom certificate, you must reorder then delete. For example, you order a dedicated custom certificate with the hostname alpha.yourdomain.com. To add the hostname beta.yourdomain.com to your dedicated custom certificate, order another dedicated custom certificate with the hostnames alpha.yourdomain.com and beta.yourdomain.com. Afterward, you must delete the original dedicated custom certificate.

The first time when you order a dedicated certificate, the Domain Control Validation (DCV) process occurs, which generates a corresponding TXT record. If you delete the TXT record, the DCV process occurs again when you order another dedicated certificate. If you delete a dedicated certificate, the TXT record corresponding to the DCV process is not deleted.

The following are common errors that are seen when you order dedicated certificates:

• Error connecting to certificate service.
• Error while requesting from certificate service.

If you receive an error when you order certificates, refresh the page and try again.

Use a provisioned certificate

IBM has partnered with several certificate authorities (CAs) to provide domain wildcard certificates for our customers. Manual verification might be required for setting up these certificates. Your support team can help you perform these additional steps.

Certificate priority at our edge

The following list denotes the priority by which the certificates are displayed at our edge:

1. Uploaded custom
2. Dedicated custom
3. Dedicated wildcard
4. Universal

Minimum TLS version

See Minimum TLS version. Higher levels of TLS provide more security, but might prevent customers from connecting to your site.