undefined | Better HN

0 pointsmtgx10y ago0 comments

One of them is not like the other, and that's CloudFlare's free SSL, which is more like "half-SSL". You only get free encryption between Cloudflare and the user, but not between your site and Cloudflare.

0 comments

lorenzhs10y ago

I don't think that's true anymore, see https://www.cloudflare.com/ssl ("Full SSL" and "Full SSL (strict)" options)

johncolanduoni10y ago

Unfortunately, this means you either have to use a self-signed cert which CloudFlare will not verify at all (meaning it can be MITMed) or use one signed by a trusted CA... which brings you back to square one.

nothrabannosir10y ago

There is still an advantage here, though: You can use a different hostname on the origin server.

Use this to serve e.g. an S3 site on your own domain using SSL: S3 -> CloudFlare (with CloudFront) uses Amazon's certificates for their hostnames. Cloudflare -> internet uses your website's hostname and certificates.

Total money spent on SSL: $0.

bradyd10y ago

CloudFlare has a free CA for signing certificates specifically for this situation. It was beta in February. Not sure if it is generally available yet.

https://blog.cloudflare.com/universal-ssl-encryption-all-the...

leni53610y ago

> self-signed cert which CloudFlare will not verify at all.

Why would they do that? I never used this feature of CloudFlare, but it would be only logical to require you to upload the cert so they can verify against it in the future.

1 more reply

incarnate10y ago

Ah, but to use the Full SSL options you need an SSL on your origin server (which CloudFlare doesn't provide for free)!

BillinghamJ10y ago

That certificate can be self signed.

2 more replies

j / k navigate · click thread line to collapse