TLS 1.3 and HTTP/2 at the edge
Cipher defaults, certificate rotation, and what we measure on every handshake.
GitFlare terminates TLS 1.3 at every colo. The default certificate is ECDSA P-256, issued and rotated automatically. Origins may keep their own certificates; we do not need a copy of your private key to pull from them over TLS.
We log handshake group, cipher, and whether the session was resumed. We do not log the certificate bytes. ALPN is h2 then http/1.1. HTTP/3 to browsers is optional per hostname.
Issue a hostname certificate
$ gitflare hostname ssl shop.example.com --issue $ gitflare hostname ssl shop.example.com --json | jq .not_after
Origin pull with your own cert
$ gitflare origin update origin.example.com \
--sni origin.example.com \
--verify-cert on
If verification fails we serve a 526 to the client and a structured error to gitflare tail. That is preferable to silently talking to the wrong origin.
What we measure
Time to first byte on the TLS path, resumed vs full handshake, and the share of X25519MLKEM768 when the client offers it. None of those numbers leave the colo except as aggregates on the analytics API.
$ curl -sS "https://api.gitflare.net/v1/analytics/tls?zone=example.com&range=24h" \ -H "Authorization: Bearer $GITFLARE_API_TOKEN" | jq .groups