# Configure the TLS Cipher Suite for HTTPS

import Tabs from '~/components/tabs/Tabs'
import Code from '~/components/Code/Code.astro'
import Apiv4Rollout from '~/includes/snippets/apiv4Rollout/en/snippet.mdx'

<Apiv4Rollout />

HTTPS applications require additional security configurations in the form of TLS cryptography. When you [configure an application](/en/documentation/products/guides/build/configure-main-settings/) with Azion, you can select the minimum TLS version supported and which cipher suite is used by the application.

There are separate instructions for API v3, which uses **Delivery** settings previously located within **Application **Main Settings. On API v4, **Delivery** settings have been moved to the new [Workloads](/en/documentation/products/secure/workloads) product.

:::tip
In this guide, there are separate instructions for API v3 and API v4. If you're not sure which steps apply to your account, see [the Verify Your Account Migration guide](/en/documentation/products/guides/verify-account-migration/) to determine if your account has already been migrated.
:::

---

## Configuring an HTTPS application

To enable the HTTPS protocol for your application:

<Tabs client:visible>
    <Fragment slot="tab.consoleworkloads">Console - Workloads</Fragment>
    <Fragment slot="tab.consoleedgeapplication">Console - Application</Fragment>
    <Fragment slot="tab.apiv3">API v3</Fragment>
    <Fragment slot="tab.apiv4">API v4</Fragment>

<Fragment slot="panel.consoleworkloads">

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Workloads**.
2. Click the Workload you want to configure.
3. In **Protocol Settings**, select the **HTTP and HTTPS support**.

To specify the [minimum TLS version](/en/documentation/products/build/applications/main-settings/#minimum-tls-version) and the [cipher suite](/en/documentation/products/build/applications/main-settings/#tls-ciphers) supported by your application, follow these steps:

1. In **Minimum TLS version**, select **TLS 1.2**.
2. Under **Cipher suite**, select **TLSv1.2_2021**.
3. Click the **Save** button.

It may take some time to propagate your changes to the edge. To verify whether your changes took place, you can inspect the `https://xxxxxxxxxx.map.azionedge.net` page using your browser and locate the security settings of the application. You can also [run the DIG command](/en/documentation/products/guides/run-the-dig-command/) to get more information on your security settings.

The application may still be running in TLS 1.3, since you selected the minimum version and *not the exact TLS version* used. However, you can check the cipher suite being used against the [list of supported ciphers](/en/documentation/products/build/applications/main-settings/#tls-ciphers) to verify whether the changes took place.

</Fragment>

<Fragment slot="panel.consoleedgeapplication">

1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > **Application**.
2. Click the application you want to configure.
3. In **Delivery Settings**, select the **HTTP and HTTPS support**.

Now to specify the [minimum TLS version](/en/documentation/products/build/applications/main-settings/#minimum-tls-version) and the [cipher suite](/en/documentation/products/build/applications/main-settings/#tls-ciphers) supported by your application:

1. In **Minimum TLS version**, select **TLS 1.2**.
2. Under **Cipher suite**, select **TLSv1.2_2021**.
3. Click the **Save** button.

It may take some time to propagate your changes to the edge. To verify whether your changes took place, you can inspect the `https://xxxxxxxxxx.map.azionedge.net` page using your browser and locate the security settings of the application. You can also [run the DIG command](/en/documentation/products/guides/run-the-dig-command/) to get more information on your security settings.

The application may still be running in TLS 1.3, since you selected the minimum version and *not the exact TLS version* used. However, you can check the cipher suite being used against the [list of supported ciphers](/en/documentation/products/build/applications/main-settings/#tls-ciphers) to verify whether the changes took place.
</Fragment>

<Fragment slot="panel.apiv4">

1. Run the following `GET` request in your terminal, replacing `[TOKEN VALUE]` with your [personal token](/en/documentation/products/guides/personal-tokens/) to retrieve your `<workload_id>`:

<Code lang="bash" code={`
curl --request GET \
  --url https://api.azion.com/v4/workspace/workloads \
  --header 'Accept: application/json' \
  --header 'Authorization: Token [TOKEN VALUE]'
`} />

2. You'll receive a response with all your existing applications. Copy the value of the `<workload_id>` that you want to configure.
3. Run a `PATCH` request to modify the application as follows:

<Code lang="bash" code={`
curl --request PATCH \
  --url https://api.azion.com/v4/workspace/workloads/<workload_id> \
  --header 'Accept: application/json' \
  --header 'Authorization: Token [TOKEN VALUE]' \
  --header 'Content-Type: application/json' \
  --data '{
    "tls": {
      "minimum_version": "tls_1_2",
      "ciphers": 4
    },
    "protocols": {
      "http": {
        "versions": ["http1", "http2"],
        "http_ports": [80],
        "https_ports": [443]
      }
    }
  }'
`} />

| Key | Description |
| --- | --- |
| `protocols` | Enables the HTTP and HTTPS protocols |
| `minimum_tls_version` | Enum that establishes the minimum TLS version |
| `ciphers` | Enum that sets the supported cipher suite. See the full list of [list of supported ciphers](/en/documentation/products/build/applications/main-settings/#tls-ciphers) for further details |

4. You'll receive a response similar to this:

<Code lang="json" code={`
    {
      "id": <workload_id>,
      "name": "My workload",
      "active": true,
      "last_editor": "your-email@example.com",
      "last_modified": "2025-08-06T17:54:18.476043Z",
      "infrastructure": 1,
      "tls": {
        "certificate": null,
        "ciphers": 4,
        "minimum_version": "tls_1_3"
      },
      "protocols": {
        "http": {
          "versions": [
            "http1",
            "http2",
            "http3"
          ],
          "http_ports": [
            80
          ],
          "https_ports": [
            443
          ],
          "quic_ports": [
            443
          ]
        }
      },
      "mtls": {
        "verification": null,
        "certificate": null,
        "crl": null
      },
      "domains": [
        "mycooltestdomain.azion.app"
      ],
      "workload_domain_allow_access": true,
      "workload_domain": "xxxxxxxxxx.map.azionedge.net",
      "product_version": "1.0"
    },
`} />


5. Wait a few minutes for the changes to propagate.
6. Check the supported cipher suite by inspecting the page or [running the DIG command](/en/documentation/products/guides/run-the-dig-command/).

:::tip
Check the [Azion API documentation](https://api.azion.com/) to know more about what the Azion API can offer.
:::

</Fragment>

<Fragment slot="panel.apiv3">

1. Run the following `GET` request in your terminal, replacing `[TOKEN VALUE]` with your [personal token](/en/documentation/products/guides/personal-tokens/) to retrieve your `<application_id>`:

<Code lang="bash" code={`
curl --location 'https://api.azionapi.net/edge_applications \
--header 'Accept: application/json; version=3' \
--header 'Authorization: Token [TOKEN VALUE]'
`} />

2. You'll receive a response with all your existing applications. Copy the value of the `<application_id>` that you want to configure.
3. Run a `PATCH` request to modify the application as follows:

<Code lang="bash" code={`
curl --location --request PATCH 'https://api.azionapi.net/edge_applications/<application_id>' \
--header 'Accept: application/json; version=3' \
--header 'Content-Type: application/json' \
--header 'Authorization: Token [TOKEN VALUE]' \
--data '{
    "delivery_protocol": "http,https",
    "minimum_tls_version": "tls_1_2",
    "supported_ciphers": "TLSv1.2_2021"
}'
`} />

| Key | Description |
| --- | --- |
| `delivery_protocol` | Enables the HTTP and HTTPS protocols |
| `minimum_tls_version` | Enum that establishes the minimum TLS version |
| `supported_ciphers` | Enum that sets the supported cipher suite. See the full list of [list of supported ciphers](/en/documentation/products/build/applications/main-settings/#tls-ciphers) for further details |

4. You'll receive a response similar to this:

<Code lang="json" code={`
{
    "results": {
        "id": <application_id>,
        "name": "example.org",
        "delivery_protocol": "http,https",
        "http_port": [
            80,
            8008
        ],
        "https_port": [
            443
        ],
        "minimum_tls_version": "tls_1_2",
        "active": true,
        "debug_rules": false,
        "http3": false,
        "websocket": false,
        "supported_ciphers": "TLSv1.2_2021",
        "application_acceleration": true,
        "caching": true,
        "device_detection": false,
        "edge_firewall": false,
        "edge_functions": true,
        "image_optimization": false,
        "l2_caching": false,
        "load_balancer": false,
        "raw_logs": false,
        "web_application_firewall": false
    }
}
`} />


5. Wait a few minutes for the changes to propagate.
6. Check the supported cipher suite by inspecting the page or [running the DIG command](/en/documentation/products/guides/run-the-dig-command/).

:::tip
Check the [Azion API documentation](https://api.azion.com/v3) to know more about what the Azion API can offer.
:::

</Fragment>

</Tabs>

---