Edge Security

Overview
DDoS Protection
- DDoS Protection Overview
- Exclusive DDoS Protection Usage
- Configuration of Exclusive DDoS protection Rules
  - Increase DDoS Protection Level
  - Exclusive DDoS Traffic Alarm
  - Configuration IP blocklist/allowlist
  - Configuration Region Blocking Rule
  - Configuration Port Filtering
  - Configuration Features Filtering
  - Configuration Protocol Blocking Rule
  - Configuration Connections Attack Protection
  - Related References
    - Action
    - Related Concepts Introduction
Web Protection
- Overview
- Managed rules
- CC attack defense
- Custom rule
- Custom Rate Limiting Rules
- Exception Rules
- Managed Custom Rules
- Web security monitoring alarm
- Refer
  - Web Protection Request Processing Order
  - Action
  - Match Condition
Bot Management
- Overview
- Bot Intelligent analysis
- Bot Basic Feature Management
- Client Reputation
- Active Detection
- Custom Bot Rule
- Bot Exception Rule
- Related References
  - Action
Rules Template
IP and IP Segment Grouping
Origin Protection
Custom Response Page
Alarm Notification
SSL/TLS
- Overview
- Deploying/Updating SSL Certificate for A Domain Name
- Configuring A Free Certificate for A Domain Name
- HTTPS Configuration
  - Forced HTTPS Access
  - Enabling HSTS
  - SSL/TLS Security Configuration
    - Configuring SSL/TLS Security
    - TLS Versions and Cipher Suites
  - Enabling OCSP Stapling

Overview

This document describes the advantages of HTTPS over HTTP, and the supported certificate types and encryption algorithms.
HTTPS Overview
As an extension of HTTP, HTTPS supports identity verification and encrypted transmission through the SSL protocol. SSL uses HTTPS certificates to verify the server's identity and establish an encrypted transmission channel between the client browser and the server. Compared to HTTP, HTTPS offers the following advantages:
Higher security: HTTPS encrypts the data exchanged between clients and servers to prevent the data from being hijacked, tampered, or listened to.
Increased website credibility: When users access a website over HTTPS, they can verify the website credibility based on its certificate. If the website is trustworthy, a green security identifier is displayed in the browser. This improves the website credibility and prevents users from accessing phishing websites.
Improved website SEO: Search engines prioritize trustworthy websites that support HTTPS. Enabling HTTPS access to a website can improve the website ranking in search engine results.
HTTPS Certificate Capabilities Supported by EdgeOne
Feature
Description
﻿Edge HTTPS Certificates﻿
Edge HTTPS certificates enable users to securely communicate with EdgeOne edge nodes via HTTPS when accessing the current domain name. Currently, EdgeOne supports configuring Edge HTTPS certificates in the following ways.
﻿Tencent Cloud SSL Certificates: If you already have a domain name certificate, you can deploy the certificate uploaded to the Tencent Cloud SSL console to an EdgeOne edge node. You can deploy at most one RSA, ECC, or SM2 certificate to the EdgeOne node simultaneously.
﻿Applying for Free Certificates: If you have not yet purchased SSL certificates, you can use EdgeOne to automatically complete the application, deployment, and renewal of free certificates, so as to reduce the operational workload. The currently applied free certificates are RSA certificates from Let’s Encrypt.
﻿Edge Mutual Authentication﻿
Edge mutual authentication means that during the communication process, both the client and the server need to prove their identities to each other. This is typically used in scenarios with high security requirements, such as corporate internal networks or financial transactions. EdgeOne supports enabling mutual authentication within edge nodes and requires the client to carry a trusted client certificate for verification during access, so as to further enhance the security of communication.
﻿Forced HTTPS Access﻿
Forced HTTPS access can redirect client HTTP requests to HTTPS via 301/302 and ultimately access EdgeOne via HTTPS, so as to ensure that all clients initiate requests to the EdgeOne node via HTTPS and ensure the security of communication.
﻿HSTS﻿
HTTP Strict Transport Security (HSTS) is a web security protocol promoted by the Internet Engineering Task Force (IETF). The protocol is used to instruct web browsers to access a site over the more secure HTTPS protocol. You can configure HSTS to improve the security and credibility of your website if you have any of the following needs: to prevent malicious attackers from stealing sensitive user information through man-in-the-middle attacks, to comply with data privacy protection regulations, or to enhance users' trust in your website.
﻿SSL/TLS Security Configuration﻿
When HTTPS access is enabled for your website, EdgeOne supports multiple SSL/TLS versions to ensure compatibility with different user terminals by default. Normally, you do not need to modify this configuration. However, if your website requires a high level of security and you need to prevent users from accessing your website through less secure SSL/TLS versions, you can customize this configuration by specifying the required SSL/TLS versions.
﻿OCSP stapling﻿
Online Certificate Status Protocol (OCSP) is provided by certificate authorities (CAs) to check the authenticity and validity of digital certificates. Whenever a user accesses a website over HTTPS, the browser initiates an OCSP query to verify whether the certificate of the website is still valid.
﻿
When OCSP stapling is enabled, EdgeOne performs OCSP queries and caches the results on servers. When a client initiates a TLS handshake with EdgeOne, EdgeOne responds with the OCSP information and certificate required for verification so that the client does not need to send a query request to the CA. This significantly improves the efficiency of the TLS handshake, reduces the time for verification, and improves the HTTPS request speed.
﻿
﻿

HTTPS Overview
HTTPS Certificate Capabilities Supported by EdgeOne

Feature	Description
Edge HTTPS Certificates	Edge HTTPS certificates enable users to securely communicate with EdgeOne edge nodes via HTTPS when accessing the current domain name. Currently, EdgeOne supports configuring Edge HTTPS certificates in the following ways. Tencent Cloud SSL Certificates: If you already have a domain name certificate, you can deploy the certificate uploaded to the Tencent Cloud SSL console to an EdgeOne edge node. You can deploy at most one RSA, ECC, or SM2 certificate to the EdgeOne node simultaneously. Applying for Free Certificates: If you have not yet purchased SSL certificates, you can use EdgeOne to automatically complete the application, deployment, and renewal of free certificates, so as to reduce the operational workload. The currently applied free certificates are RSA certificates from Let’s Encrypt.
Edge Mutual Authentication	Edge mutual authentication means that during the communication process, both the client and the server need to prove their identities to each other. This is typically used in scenarios with high security requirements, such as corporate internal networks or financial transactions. EdgeOne supports enabling mutual authentication within edge nodes and requires the client to carry a trusted client certificate for verification during access, so as to further enhance the security of communication.
Forced HTTPS Access	Forced HTTPS access can redirect client HTTP requests to HTTPS via 301/302 and ultimately access EdgeOne via HTTPS, so as to ensure that all clients initiate requests to the EdgeOne node via HTTPS and ensure the security of communication.
HSTS	HTTP Strict Transport Security (HSTS) is a web security protocol promoted by the Internet Engineering Task Force (IETF). The protocol is used to instruct web browsers to access a site over the more secure HTTPS protocol. You can configure HSTS to improve the security and credibility of your website if you have any of the following needs: to prevent malicious attackers from stealing sensitive user information through man-in-the-middle attacks, to comply with data privacy protection regulations, or to enhance users' trust in your website.
SSL/TLS Security Configuration	When HTTPS access is enabled for your website, EdgeOne supports multiple SSL/TLS versions to ensure compatibility with different user terminals by default. Normally, you do not need to modify this configuration. However, if your website requires a high level of security and you need to prevent users from accessing your website through less secure SSL/TLS versions, you can customize this configuration by specifying the required SSL/TLS versions.
OCSP stapling	Online Certificate Status Protocol (OCSP) is provided by certificate authorities (CAs) to check the authenticity and validity of digital certificates. Whenever a user accesses a website over HTTPS, the browser initiates an OCSP query to verify whether the certificate of the website is still valid. When OCSP stapling is enabled, EdgeOne performs OCSP queries and caches the results on servers. When a client initiates a TLS handshake with EdgeOne, EdgeOne responds with the OCSP information and certificate required for verification so that the client does not need to send a query request to the CA. This significantly improves the efficiency of the TLS handshake, reduces the time for verification, and improves the HTTPS request speed.