DEV Community

Lia
Lia

Posted on

How to Deploy SafeLine WAF and Enforce TLS 1.2 and TLS 1.3

#websecurity #tlscompliance #reverseproxy #firewall

SafeLine is a self-hosted web application firewall that sits in front of your web apps as an HTTP/HTTPS reverse proxy (https://docs.waf.chaitin.com/en/home). Because the engine is built on nginx, the TLS stack that terminates client traffic is an nginx layer, which is where TLS 1.2 and TLS 1.3 compliance is managed (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). The workflow below gets an instance running first, then applies a TLS compliance checklist.

Step 1: Verify prerequisites. The deployment guide lists these minimums: a Linux operating system, x86_64 or arm64 architecture, Docker 20.10.14 or above, Docker Compose 2.0.0 or above, and at least 1 CPU core, 1 GB memory, and 5 GB disk (https://docs.waf.chaitin.com/en/GetStarted/Deploy). Confirm your server with these commands: uname -m, docker version, docker compose version, free -h, df -h, and lscpu | grep ssse3.

Step 2: Run automatic deployment. This is the recommended path and requires root privileges (https://docs.waf.chaitin.com/en/GetStarted/Deploy):
bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

Step 3: Manual deployment (alternative). Install Docker, create the directory /data/safeline, download the latest compose.yaml with wget, write the .env file, generate the DETECTOR_MGMT_TOKEN, MGT_INTERNAL_TOKEN, and DETECTOR_AES_KEY secrets, set restrictive file permissions, and run docker compose up -d (https://docs.waf.chaitin.com/en/GetStarted/Deploy). On ARM servers, set ARCH_SUFFIX=-arm.

Step 4: Create the administrator account. Run docker exec safeline-mgt resetadmin to receive the initial username admin and a generated password, and store both safely (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

Step 5: Open the web console. Browse to https://:9443/ and log in with the credentials from the previous step (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

Step 6: Add and proxy an application. Go to the Applications page, click Add Application, and enter the Domain, Port (80 or 443), and Upstream address. For HTTPS applications, check the SSL option, then resolve the domain name to the SafeLine server IP (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

TLS 1.2 and TLS 1.3 compliance checklist. The official documents describe SafeLine as an nginx-based reverse proxy but do not document a dedicated TLS-version menu, so treat compliance as a reverse-proxy hardening task instead of assuming a one-click toggle. Work through these checks.

  • Confirm the application listens on port 443 with SSL enabled in SafeLine (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).
  • Verify the negotiated protocol with openssl s_client -connect yourdomain:443 -tls1_2 and openssl s_client -connect yourdomain:443 -tls1_3.
  • Disable legacy TLS 1.0 and 1.1 at the nginx layer so only TLSv1.2 and TLSv1.3 are accepted.
  • Restrict the cipher list to modern, forward-secret options and enforce the server cipher preference.
  • Keep the certificate, private key, and intermediate chain current, and automate renewal before expiry.
  • Re-run a TLS scanner after changes and review SafeLine logs in the web console for failed handshakes or blocked traffic.

Where do I enable TLS 1.2 and TLS 1.3?

The supplied SafeLine documents do not specify a dedicated TLS-version toggle, so protocol selection lives in the nginx reverse-proxy configuration that SafeLine builds on. Start by confirming SSL is enabled for the application, then set the nginx protocol line to TLSv1.2 TLSv1.3 and remove TLSv1 and TLSv1.1 (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

Does SafeLine terminate HTTPS on port 443?

Yes. When you add an application you choose the port SafeLine listens on, such as 443, and for HTTPS apps you enable the SSL option so SafeLine handles the encrypted connection before forwarding cleaned traffic upstream (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

What happens if I skip the SSL option?

The SSL option tells SafeLine that the proxied application is HTTPS. Skipping it for a 443 application will produce a mismatch between the listener and the upstream protocol, so enable it for TLS-protected apps (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

How do I verify TLS compliance after setup?

Use openssl s_client against port 443 with the -tls1_2 and -tls1_3 flags to confirm each protocol handshake succeeds, and use -tls1 or -tls1_1 to confirm legacy versions are rejected. Follow that with an external TLS scanner and a review of the console logs (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

Are there special steps for ARM servers?

Yes. The deployment guide says to set ARCH_SUFFIX=-arm for ARM deployments, and it notes that the Personal Edition is not supported on ARM while a Pro license is required for ARM to work properly (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.

Top comments (0)