Hacker News Reader

Comment by shcheklein | Hacker News Reader

The easiest way to manage I've found so far - put it behind Cloudflare. Caching, certs management, www. redirect handling (with SSL support), basic protection - all comes for free. You would need to install their own cert on your infra, but it has 10 or 15 year to expire.

View on HN

Then you're shunning anyone who uses a VPN, anyone who uses privacy plugins, etc etc.

I despise Cloudflare these days because I'm pretty much required to use a VPN to access the web and get around geolocked content everywhere, and then Cloudflare blocks me from browsing even basic static sites.

Interesting, I've never tried this. I'll check it out.

CloudFlare, being a reverse proxy, has many limitations (such as forced cookies and the upload limit) but I agree that it is ok for many use cases. Let's Encrypt is easily automated and doesn't have any of those downsides.

Are there still "forced cookies" after this change? https://blog.cloudflare.com/deprecating-cfduid-cookie/

Not an option for Australia clients on the free tier - it gets routed through Hong Kong! :(

In any case, Cloudfront has been a cheap value option with a easy DNS based certificate renewal process.

>it has 10 or 15 years to expire

Dont browsers reject certs with longer than one year validity?

They’re talking about the cert between edge and origin (I.e. cloudflare and your server). The client never sees that cert because they don’t talk directly to your origin.

This is the internal traffic between CF and you. So it's never exposed to browsers.

Reply on news.ycombinator.com