[SSL] expand PCI DSS compliance guide - #33160
Open
ngayerie wants to merge 3 commits into
Open
Conversation
github-actions
Bot
added
product:ssl
Contributor
|
This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:
|
ngayerie
changed the title
Contributor
|
Preview URL: https://d6c67d06.preview.developers.cloudflare.com Files with changes (up to 15)
|
ngayerie
marked this pull request as ready for review
September 1, 2026 09:25
ngayerie
requested review from
a team,
baubuchon-cf,
danielegm,
lgarofalo and
xmflsct
as code owners
September 1, 2026 09:25
Contributor
Review
👉 Fix in your agent 👈Fix the following review findings in PR #33160 (https://github.com/cloudflare/cloudflare-docs/pull/33160).
Before making changes, review each finding and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g. the fix requires disproportionate effort for minimal benefit,
or the finding is factually incorrect), explain why
- If you need clarification before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order
After triaging, follow this order:
1. Post a comment on this PR for any findings you are skipping, with the finding ID and your reasoning.
2. Then commit the fixes for the legitimate findings.
The comment must come before the commit — the bot reads PR comments when a new
push triggers a review, so skip comments posted after the push will be missed.
---
## Code Review
### Suggestions (1)
#### CR-9930d0289cce · Duplicate/leftover content
- **File:** `src/content/docs/ssl/reference/compliance-and-vulnerabilities.mdx` line 210
- **Issue:** The added paragraph 'Cloudflare's WAF may block attack-pattern traffic used by ASV scanners...' restates the opening paragraph of the same 'WAF and DDoS blocking ASV scanners' section ('ASV scanners send attack-pattern traffic ... Cloudflare's WAF blocks many of these probes, which is correct WAF behavior, but it can prevent the scanner from completing its assessment.'), and it sits after the section's numbered instructions and caution as a trailing sentence.
- **Fix:** Remove this trailing paragraph — the section intro already covers the WAF-blocking-ASV-scanners point, and the numbered steps give the concrete remediation. If the ASV/QSA coordination point is meant to stay, fold it into the section intro instead of duplicating it at the end.
---
## Conventions
### Warnings (1)
#### CV-05dd3639321e · Scope accuracy
- **File:** PR-level finding
- **Issue:** The description states that `/client-side-security/reference/pci-dss/` was "expanded from a one-paragraph stub to a full requirements mapping table", but the PR's changed files only include `src/content/docs/ssl/reference/compliance-and-vulnerabilities.mdx` (+227/-41). The described scope does not match the actual diff.
- **Fix:** Align the description with the diff: either include the client-side-security/pci-dss change in this PR or remove that bullet from the description.
Code ReviewThis code review is in beta and may not always be helpful — use your judgment. Suggestions (1)
ConventionsWarnings (1)
Style Guide ReviewNo style-guide issues found. CommandsOnly codeowners can run commands. Post a comment with the command to trigger it.
|
Collaborator
Author
|
Skipping CR-31043405b1be (Incorrect technical claim about certificate redeployment). The claim that "Updating cipher suites triggers certificate redeployment" is not an error introduced by this PR — it is sourced verbatim from the existing |
zeinjaber
reviewed
Sep 1, 2026
zeinjaber
approved these changes
Sep 2, 2026
zeinjaber
approved these changes
Sep 3, 2026
DEE-3623
ngayerie
force-pushed
the
dee-3623-pci-dss-compliance-guide
branch
from
September 4, 2026 11:34
40e0d35 to
be54822
Compare
DEE-3623 - SSL Labs: describe what to verify (rejected protocols, passing ciphers) rather than pointing to a specific grade - Shared responsibility table: add ACM subscription requirement to cipher suite row - WAF/ASV section: remove unverified PCI requirement citation; replace with neutral guidance to work with ASV and QSA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Expands the PCI DSS compliance documentation to address a gap identified in the SSL/TLS Clarity Report (theme 11).
DEE-3623
Changes
/ssl/reference/compliance-and-vulnerabilities/: rewritten as a complete how-to guide covering minimum TLS 1.2, PCI DSS cipher suite profile, TLS 1.3, configuration verification, Cloudflare Pages limitation, PCI DSS v4 client-side requirements (req 6.4.3 and 11.6.1), ASV scan behaviour, and known scanner false positives/client-side-security/reference/pci-dss/: expanded from a one-paragraph stub to a full requirements mapping table for PCI DSS v4.0 req 6.4.3 and 11.6.1, with setup steps and cross-links