undefined | Better HN

0 pointslorenzhs10y ago0 comments

I don't think that's true anymore, see https://www.cloudflare.com/ssl ("Full SSL" and "Full SSL (strict)" options)

0 comments

Unfortunately, this means you either have to use a self-signed cert which CloudFlare will not verify at all (meaning it can be MITMed) or use one signed by a trusted CA... which brings you back to square one.

nothrabannosir10y ago

There is still an advantage here, though: You can use a different hostname on the origin server.

Use this to serve e.g. an S3 site on your own domain using SSL: S3 -> CloudFlare (with CloudFront) uses Amazon's certificates for their hostnames. Cloudflare -> internet uses your website's hostname and certificates.

Total money spent on SSL: $0.

bradyd10y ago

CloudFlare has a free CA for signing certificates specifically for this situation. It was beta in February. Not sure if it is generally available yet.

https://blog.cloudflare.com/universal-ssl-encryption-all-the...

leni53610y ago

> self-signed cert which CloudFlare will not verify at all.

Why would they do that? I never used this feature of CloudFlare, but it would be only logical to require you to upload the cert so they can verify against it in the future.

daurnimator10y ago

They only let you do that on the $200 a month business plan

incarnate10y ago

Ah, but to use the Full SSL options you need an SSL on your origin server (which CloudFlare doesn't provide for free)!

BillinghamJ10y ago

That certificate can be self signed.

mehrdada10y ago

In which case, it can be easily MITM'd by an attacker sitting between CloudFlare and your server, which makes it only slightly better than plain HTTP. It would have been great if CloudFlare let the user to upload and pin a specific self-signed certificate that it could then validate to prevent such attacks.

gurrone10y ago

I think there was some rumors that they are - or are planing - to offer certificates signed by a private Cloudflare CA exactly for the purpose of encrypting the traffic to the backend.

j / k navigate · click thread line to collapse