Hacker News Reader

Comment by lorenzhs | Hacker News Reader

I don't think that's true anymore, see https://www.cloudflare.com/ssl ("Full SSL" and "Full SSL (strict)" options)

Unfortunately, this means you either have to use a self-signed cert which CloudFlare will not verify at all (meaning it can be MITMed) or use one signed by a trusted CA... which brings you back to square one.

> self-signed cert which CloudFlare will not verify at all.

Why would they do that? I never used this feature of CloudFlare, but it would be only logical to require you to upload the cert so they can verify against it in the future.

They only let you do that on the $200 a month business plan

There is still an advantage here, though: You can use a different hostname on the origin server.

Use this to serve e.g. an S3 site on your own domain using SSL: S3 -> CloudFlare (with CloudFront) uses Amazon's certificates for their hostnames. Cloudflare -> internet uses your website's hostname and certificates.

Total money spent on SSL: $0.

CloudFlare has a free CA for signing certificates specifically for this situation. It was beta in February. Not sure if it is generally available yet.

https://blog.cloudflare.com/universal-ssl-encryption-all-the...

Ah, but to use the Full SSL options you need an SSL on your origin server (which CloudFlare doesn't provide for free)!

That certificate can be self signed.

In which case, it can be easily MITM'd by an attacker sitting between CloudFlare and your server, which makes it only slightly better than plain HTTP. It would have been great if CloudFlare let the user to upload and pin a specific self-signed certificate that it could then validate to prevent such attacks.

I think there was some rumors that they are - or are planing - to offer certificates signed by a private Cloudflare CA exactly for the purpose of encrypting the traffic to the backend.

Reply on news.ycombinator.com