diff --git a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx
index bd15818da533e7d..b1a01fb13ae9f40 100644
--- a/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx
+++ b/src/content/docs/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls.mdx
@@ -8,13 +8,13 @@ head:
content: TLS Settings — Cloudflare for SaaS
---
-import { AvailableNotifications, Details, Render } from "~/components";
+import { AvailableNotifications, Details, Render, APIRequest } from "~/components";
[Mutual TLS (mTLS)](https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/) adds an extra layer of protection to application connections by validating certificates on the server and the client. When building a SaaS application, you may want to enforce mTLS to protect sensitive endpoints related to payment processing, database updates, and more.
-[Minimum TLS Version](/ssl/edge-certificates/additional-options/minimum-tls/) allows you to choose a cryptographic standard per custom hostname. Cloudflare recommends TLS 1.2 to comply with the Payment Card Industry (PCI) Security Standards Council.
+[Minimum TLS Version](#minimum-tls-version) only allows HTTPS connections from visitors that support the selected TLS protocol version or newer. Cloudflare recommends TLS 1.2 to comply with the Payment Card Industry (PCI) Security Standards Council. As a SaaS provider, you can control the Minimum TLS version for your zone as a whole, as well as for individual custom hostnames.
-[Cipher suites](/ssl/edge-certificates/additional-options/cipher-suites/) are a combination of ciphers used to negotiate security settings during the [SSL/TLS handshake](https://www.cloudflare.com/learning/ssl/what-happens-in-a-tls-handshake/). As a SaaS provider, you can [specify configurations for cipher suites](#cipher-suites) on your zone as a whole and cipher suites on individual custom hostnames via the API.
+[Cipher suites](#cipher-suites) are a combination of ciphers used to negotiate security settings during the [SSL/TLS handshake](https://www.cloudflare.com/learning/ssl/what-happens-in-a-tls-handshake/). As a SaaS provider, you can specify configurations for cipher suites on your zone as a whole and cipher suites on individual custom hostnames via the API.
:::caution
When you [issue a custom hostname certificate](/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/) with wildcards enabled, any cipher suites or Minimum TLS settings applied to that hostname will only apply to the direct hostname.
@@ -27,25 +27,94 @@ However, if you want to update the Minimum TLS settings for all wildcard hostnam
Once you have [added a custom hostname](/cloudflare-for-platforms/cloudflare-for-saas/start/getting-started/), you can enable mTLS by using Cloudflare Access. Go to [Cloudflare Zero Trust](https://one.dash.cloudflare.com/) and [add mTLS authentication](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/) with a few clicks.
:::note
-
Currently, you cannot add mTLS policies for custom hostnames using [API Shield](/api-shield/security/mtls/).
+:::
+
+## Minimum TLS Version
+:::note
+While TLS 1.3 is the most recent and secure version, it is not supported by some older devices. Refer to Cloudflare's recommendations when [deciding what version to use](/ssl/reference/protocols/#decide-which-version-to-use).
:::
-## Enable Minimum TLS Version
+### Scope
-1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and navigate to your account and website.
+Minimum TLS version exists both as a [zone-level setting](/ssl/edge-certificates/additional-options/minimum-tls/) (under **Edge certificates** > **Minimum TLS Version**) and as a custom hostname setting. What this implies is:
-2. Select **SSL/TLS** > **Custom Hostnames**.
+- For custom hostnames created via API, it is possible not to explicitly define a value for `min_tls_version`. When that is the case, whatever value is defined as your zone's minimum TLS version will be applied. To confirm whether a given custom hostname has a specific minimum TLS version set, use the following API call.
-3. Find the hostname to which you want to apply Minimum TLS Version. Select **Edit**.
+
-4. Choose the desired TLS version under **Minimum TLS Version** and click **Save**.
+
-:::note
+```json title="Response example" collapse={5-16, 21-40} ""settings": {},"
+ "success": true,
+ "result": {
+ "id": "",
+ "ssl": {
+ "id": "",
+ "bundle_method": "ubiquitous",
+ "certificate_authority": "",
+ "custom_certificate": "",
+ "custom_csr_id": "",
+ "custom_key": "",
+ "expires_on": "",
+ "hosts": [
+ "app.example.com",
+ "*.app.example.com"
+ ],
+ "issuer": "",
+ "method": "http",
+ "settings": {},
+ "signature": "SHA256WithRSA",
+ "type": "dv",
+ "uploaded_on": "2020-02-06T18:11:23.531995Z",
+ "validation_errors": [
+ {
+ "message": "SERVFAIL looking up CAA for app.example.com"
+ }
+ ],
+ "validation_records": [
+ {
+ "emails": [
+ "administrator@example.com",
+ "webmaster@example.com"
+ ],
+ "http_body": "ca3-574923932a82475cb8592200f1a2a23d",
+ "http_url": "http://app.example.com/.well-known/pki-validation/ca3-da12a1c25e7b48cf80408c6c1763b8a2.txt",
+ "txt_name": "_acme-challenge.app.example.com",
+ "txt_value": "810b7d5f01154524b961ba0cd578acc2"
+ }
+ ],
+ "wildcard": false
+ },
+ }
+```
-While TLS 1.3 is the most recent and secure version, it is not supported by some older devices. Refer to Cloudflare's recommendations when [deciding what version to use](/ssl/reference/protocols/#decide-which-version-to-use).
-:::
+
+
+- Whenever you make changes to a custom hostname via dashboard, the value that is set for Minimum TLS version will apply. If you have a scenario as explained in the bullet above, the dashboard change will override the zone-level configuration that was being applied.
+
+- For custom hostnames with wildcards enabled, the direct custom hostname you create (for example, `saas-customer.test`) will use the hostname-specific setting, while the others (`sub1.saas-customer.test`, `sub2.saas-customer.test`, etc) will default to the zone-level setting.
+
+### Setup
+
+
+
+Refer to [Minimum TLS version - SSL/TLS](/ssl/edge-certificates/additional-options/minimum-tls/#zone-level).
+
+
+
+
+
+1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your account and website.
+2. Go to **SSL/TLS** > **Custom Hostnames**.
+3. Find the hostname to which you want to apply Minimum TLS Version. Select **Edit**.
+4. Choose the desired TLS version under **Minimum TLS Version** and select **Save**.
+
+
## Cipher suites
diff --git a/src/content/docs/ssl/edge-certificates/additional-options/minimum-tls.mdx b/src/content/docs/ssl/edge-certificates/additional-options/minimum-tls.mdx
index 656dff8cb25c734..6c9dda333886696 100644
--- a/src/content/docs/ssl/edge-certificates/additional-options/minimum-tls.mdx
+++ b/src/content/docs/ssl/edge-certificates/additional-options/minimum-tls.mdx
@@ -92,6 +92,11 @@ In the following example, the minimum TLS version for a specific hostname will b
}}
/>
+### Cloudflare for SaaS
+
+If you are a SaaS provider looking to configure minimum TLS version for your custom hostnames, refer to the Cloudflare for SaaS [TLS management](/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls/#minimum-tls-version).
+
+
## Test supported TLS versions
To test supported TLS versions, attempt a request to your website or application while specifying a TLS version.
diff --git a/src/content/partials/cloudflare-for-platforms/create-custom-hostname-limitations.mdx b/src/content/partials/cloudflare-for-platforms/create-custom-hostname-limitations.mdx
index af7d350c3a4db9e..e70192ef25ae6e5 100644
--- a/src/content/partials/cloudflare-for-platforms/create-custom-hostname-limitations.mdx
+++ b/src/content/partials/cloudflare-for-platforms/create-custom-hostname-limitations.mdx
@@ -9,7 +9,7 @@
When you create a custom hostname:
* If you issue a custom hostname certificate with wildcards enabled, you cannot customize TLS settings for these wildcard hostnames.
-* If you do not specify the **Minimum TLS Version**, it defaults to 1.0, not the zone's Minimum TLS Version. You can still edit this setting after creation.
+* If you do not specify the **Minimum TLS Version**, it defaults to the zone's Minimum TLS Version. You can still [edit this setting](/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/enforce-mtls/#minimum-tls-version) after creation.
:::