The Irrevocable SSL Certificates of Cloudflare | Hacker News Reader

The Irrevocable SSL Certificates of Cloudflare

worldofmatthew.com

104 pointshurutparittya89 comments

I'm struggling to understand the mindset in which this seems "corrupt".

The post isn't happy that cloudflare offers free DDOS protection, instead they are so upset that using the free level doesn't allow you to revoke their certificate for your website that they accuse cloudflare of being corrupt.

That's grossly unfair to cloudflare. If you didn't want them to have a certificate for your website, don't give it to them!

I guess it could be argued that Cloudflare's free level is set up as a trap, where it's presented as free but if something goes wrong it costs money to fix it.

But that's not really what's happening here, is it? Theyre complaining that cloudflare doesn't have a way to revoke certificates after the user specifically asked cloudflare to create one for them - transparently, so they dont have to bother with the keys to this certificate.

I'd wager the reason why this feature doesn't exist is because - by the time someone will want to revoke it, the private key for the certificate will have already been deleted, making revocation impossible.

Honestly, this article has probably been written by someone that doesn't actually know how the certificates are created and revoked, forgot to remove a cname entry on their DNS and now wants to drum up controversy for clicks from ppl that probably shouldn't participate in the discussion either, as they're most likely not as informed as they think they're.

And while I was a sysadmin around 10 yrs ago, which gives me a rudimentary understanding of the lifecycle of these certificates... I wouldn't call myself an expert either .

Certificates are created regardless of whether you ask for them by using features like proxying traffic through CF. Just using them as a DNS service provider is enough for certs to be issued (with "proxy=off" or no A/CNAME records at all, it doesn't matter).

> Just using them as a DNS service provider is enough

With a cname you yield the control of one domain name, by setting an NS record you're literally passing over any and all control to cloudflare.

That's at a level of entering a shop that advertises itself as "diverse" and then complain that the male cashier was wearing makeup...

It's not like cloudflare makes it a secret that their goal is to take care of everything for their users. It's kinda the while point of using cloudflare, because theyre so easily to use... Because they're doing everything for you.

Not if you disable Universal SSL

https://developers.cloudflare.com/ssl/edge-certificates/univ...

This honestly i never even thought about this, i mean sure Cloudflare COULD MITM them, but if the dns is already running through cloudflare, they could just reissue a new DNS challenged LetsEncrypt cert, they don't need your old cert to reissue a new one if they're the MITM and DNS hoster lol.

Bitching about a cert not being revoked, is kinda silly since the guys running like 50% of the internet could easily just reissue a new letsencrypt cert to replace the one you "revoked" if they were mischeveous.

> could easily just reissue a new letsencrypt cert

This would be visible in certificate transparency logs. MITM with the certificate they already have would be impossible to observe unless you had access to the client that was being attacked.

I ran into a similarly weird issue with CloudFlare. This post made me check my domain that I recently bought.

I bought the domain passkey.exchange through Cloudflare on 12 April and I didn't set up ANYTHING on it. No DNS records. Nothing. I didn't touch it since

Yet. Exactly at the purchase time. 3 certificates where added to the certificate transparency log:

2 from LetsEncrypt and one from Google. How?

https://crt.sh/?q=passkey.exchange

The only explanation that i have is that Cloudflare is doing some kind of integration testing after you buy a domain from them on Google Cloud and LetsEncrypt before giving you the domain.

But that means they have some private key somewhere for 90 days. Across two different CAs..

Or I have really bad memory. Set up some Infrastructure on Google Cloud and then deprovisioned it again and removed all DNS records.

Or I was hacked.

It's really strange.

Edit: digging further it must've been Cloudflare.

The google cert has

Not Before: Apr 12 22:01:51 2024 GMT

My invoice is dated 22:49 UTC. One hour after the cert was issued?

Yes, Cloudflare controls your DNS and they advertise setting up HTTPS for you. If they'd wait until you added a DNS record that's routed through them, which they are by default, then that'd be poor user experience.

The timestamp difference is probably just Google backdating the certificate by an hour or 30 minutes to deal with clients whose clocks lag behind.

What method do they use to get the certificate? I'd guess ACME DNS-01 challenge, but that means they are setting DNS records you didn't explicitly ask for. Getting a TLS certificate is pretty quick, I'd probably prefer to wait 10 seconds versus having unexpected DNS records.

(edit: although I'm a DevOps engineer and I wrote my own subdomain registration service, so my preference will certainly not match others).

> but that means they are setting DNS records you didn't explicitly ask for

Sure, that's what you're paying them for. Cloudflare is not a "dumb" domain registrar, they are an integrated service.

> Getting a TLS certificate is pretty quick

Most of the time, yes. Sometimes there are outages or whatever. It makes sense to just get it done ASAP.

Distributing that TLS certificate to their edge network may take some time as well, and who knows what other internal prep they need to do.

> that means they are setting DNS records you didn't explicitly ask for.

If you make a CAA record on Cloudflare then they add extra invisible CAA records which authorize the ~4 different CAs they use for CDN certificates. They really assume you're using the whole stack, not just DNS.

Many (most?) registrars add DNS you didn't explicitly ask for, like an A record on the root that says "this domain was purchased from Namecheap" or whatever.

Do you know of a registrar that doesn't do that?

I've never used a registrar that does do that.

How would you know? It's not like those records are displayed in their configuration panel and the only way to request TXT records for e.g. a subdomain is to know that subdomain even exists ahead of time.

If we're still talking about TLS certs, the transparency log has that info (mentioned in the article). I also assume this thread is talking about the domain and any subdomains you're actually using. What would the reason be of setting TXT records for unguessable subdomains?

My comment was regarding DNS records, since this subthread switched to talking about DNS 2 comments up:

> Many (most?) registrars add DNS you didn't explicitly ask for

This relates to TLS since DNS records can be used to request a TLS certificate, but yes, those show in the certificate transparency log, so that you can check. But it won't tell you about other DNS records that may be used for various other purposes.

Did you have any purposes in mind? An A record for the apex of the domain would be easy to find with dig or any other DNS client. I agree with the hypothetical though, your DNS provider can set records that you didn't request, could hide them in the console, and detecting these would be hard in the general case.

Not really, the point is more that you wouldn't easily find out if they did that.

When you buy a domain, they ask you which nameservers the domain should point to, right? They won't be able to do this shenanigan if you point it to nameservers outside of their control.

Correct, though usually they don't ask during signup. They tend to default to their own nameservers, then let you change it afterwards.

In the case of cloudflare, it means not being able to use the majority of their services.

Actually if you use Cloudflare Registrar, you must use Cloudflare DNS. That's the deal. "We provide registration services with absolutely no markup, you use our DNS for that domain".

DNSimple doesn’t do that (https://dnsimple.com/)

Disclaimer: I’ve been an engineer on various CAs in the past.

If you run into this issue, contact the CA directly and not Cloudflare.

The CA is required to handle your request within 24 hours. If they do not, that is an incident for the CA.

And Let's Encrypt actually provides an API for this: https://letsencrypt.org/docs/revoking/#using-a-different-aut...

I don't think it makes a significant difference (I believe browsers don't implement revocation in any meaningful way), but the option exists.

Lots of browsers avoid it for reasons, but isn't this the whole point of the OCSP(https://en.m.wikipedia.org/wiki/Online_Certificate_Status_Pr...) and OCSP stapling?

Yes, protocols for this exist... but as you said, browsers tend to avoid them.

Edit: Firefox seems to check revocation by default. https://revoked.badssl.com/ if you want to test.

This requires the certificat's private key, right? Can you download the key for letsencrypt certificates generated by cloudflare?

No, if you can complete challenges for every DNS name in the certificate then the API lets you revoke it.

No, as the section I linked explains, you can also prove that you own the domain and then revoke the cert without having the private key. It's meant exactly for cases where some other party has obtained a cert for your domain for whatever reason (change of ownership, compromise, ...)

Firefox does do revocation.

Huh, you're right - it also seems to be enabled by default. I tried with a clean profile and https://revoked.badssl.com/ showed an error (Chrome loads the page).

iOS Safari also shows an error and refuses to load the page.

This is a valid request, right? You'd claim that you've withdrawn permission from CF (not that the key was compromised). Looking at this RFC: https://datatracker.ietf.org/doc/html/rfc5280

And CF has no obligation to revoke the cert when it's no longer needed, nor to act as a free middleman between domain owner and CA.

CF does “technically” have that obligation under many subscriber agreements.

Cloudflare could make this much easier by revoking the cert when the customer moves away from them. They probably should do this.

It's not your certificate, it's theirs and they're letting you use it.

The domain is yours, but you let them complete domain validation to get their certificate.

Revocation for random domains is kind of a moo point as chrome doesn’t do OCSP default, just CRLsets that are pushed out with browser releases, that probably won’t include your domain.

Better instead just to have shorter TTL certs.

Yes, and note that Cloudflare supports 30-day certs, and in fact IIRC Cloudflare doesn’t issue 1-year certs at all any more

I checked two domains registered through Cloudflare about a week ago and both have 1-year certificates issued by Sectigo, valid until May 2025. Never enabled DDoS protection or any other features besides editing DNS records.

This paper seems relevant. It describes a new CT log with additional revocation transparency.

https://eprint.iacr.org/2021/818.pdf

For it to be useful, I imagine clients would need to query some central service every time it receives a certificate it has not seen before, which could potentially be a privacy concern. The only other alternative seems to be for clients to sync the entire revocation log, which would quickly grow in size.

Clients could sync a bloom filter of revoked certificates. If the client encounters a certificate that matches the boom filter it would still need to check some online service to see whether the certificate was revokes or was a false positive. But for most unrevoked certificates the bloom filter would already tell you that it isn't revoked. Another benefit over a pure online service is that when you get a new bloom filter you check all known certificates against it to mark known certificates for rechecking (in case they got revoked since you last visited that page)

I recently noticed that Cloudflare issued multiple, year-long certificates for one of my domains that has NOTHING to do with Cloudflare services. Trying to get them revoked has been an exercise in frustration and futility.

Can you email me (jgc@cloudflare.com) with details? I can't see any way we'd be issuing a certificate for a domain that's got nothing to do with us. I'd like to investigate.

Wow I certainly did not expect this to catch the ears of The JGC. I shot an email, thanks!

If that is true then it is huge news. When you say "NOTHING to do with Cloudflare services" do you really mean that you have never used them as a registrar or DNS host for that domain? Have you perhaps used another provider that is reselling/whitelabeling cloudflare services?

Yes, I should have been a lot clearer before throwing out an accusation like that. What I meant to say is that to the best of my knowledge I'm not using any of their services directly. The first thing I suspected was that Porkbun, my registrar and NS provider, requested them on my behalf for some service they offer. This would still be odd, as I do not recall ever using any of their services that would require this either, and their support stated that they don't recognize the certs.

My main gripe with Cloudflare is not that they issued these certificates. It's the fact that they are valid for one(1) year and I don't have an easy, preferably automated way to have them revoked.

Looks like porkbuns DNS runs on cloudflare: https://lowendspirit.com/discussion/4602/porkbun-ns-moving-t... https://kb.porkbun.com/article/216-how-to-enable-porkbuns-cl...

So it might have been a misconfiguration on porkbuns or cloudflares (or maybe a porkbun feature that requires the cloudflare cert) end that created a cert.

Seems like porkbun should be more clear about that using "their" DNS might lead to cloudflare issuing certs for those domains.

That would be the most likely scenario, yes.

I’ve just checked my domains hosted with Porkbun and it looks similar that Cloudflare has been issuing themselves certificates for my domains.

I do trust Cloudflare and Porkbun, but it does feel a little icky to happen without /any/ feedback or being informed.

I’d at least like to see the DNS entries in the Porkbun UI!

Which CA is this? Contact their CPR endpoint and tell them you want it revoked.

Don’t bother going through Cloudflare.

If they don’t respond to you within 24 hours, let me know and we can start an incident against that CA.

That was my first instinct as well!

I reached out to Digicert at revoke@digicert.com. They responded almost immediately and directed me to Cloudflare's abuse report form, where I was met with a wall. Now I'm back to Digicert asking them to please revoke them.

Note that this isn't an urgent security situation, as the domain in question isn't in use currently. It's more of an annoyance, since the certs are valid for 1 year.

Certificates in question: https://crt.sh/?id=11447235791 https://crt.sh/?id=11447092451

This is actually very interesting. Please let me know what digicert says once you say your request again. If they push back on this I’ll escalate it with your permission.

I see the still haven’t revoked your cert. Has digicert started the revocation process?

I tried replying to the existing email thread which did not get a response. Tomorrow I'll attempt starting a new case, with a more clearly worded request. I'll let you know how that goes.

Great success. This time it went without any issues and got the certificates revoked within 6 hours of my first email.

Awesome!

> In fact, the official stance of the SSL team at CloudFlare is that they won’t revoke unless the team has “determined the private key was compromised.”

Sounds like you should email the private key to the Cloudflare security team as plain text

It's not possible to get the private key for CloudFlare issued TLS certificates.

Another example of pay-to-play is their Keyless SSL for Enterprise only customers: https://developers.cloudflare.com/ssl/keyless-ssl/

I've wanted to use their infrastructure for years, but I just can't bring myself to relinquish private key control.

Under what circumstances do you need to give Cloudflare your private keys? Certificates they acquire for their services (on your domain) use their own private keys.

Any private keys for your domain are your private keys. What makes them yours is who they allow to be impersonated.

I’ve been wanting to move off Cloudflare for a while for some self hosted things (I bought the domain on CF and had to wait a few months for it to be allowed to transfer). What registrar do people recommend? (other than porkbun which refuses to let me sign up with a VPN)

Because Germany, I use INWX as a domain registrar, they send me PDF invoices, which many others don't (used several other services, most where a pain with invoices and my accountant).

I use Bunny CDN for DNS services.

I used to be on INWX (and still am for some .de domains), but they charge up to 2x for some gTLDs when compared to Cloudflare.

"We've been on the Cloudflare Business plan ($250/month) for years. They suddenly contacted us and asked us to either pay them $120k up front for one year of Enterprise within 24 hours or they would take down all of our domains."

I'm sure INWX is not going to do this (#alleggsinonebasket)

https://robindev.substack.com/p/cloudflare-took-down-our-web...

inwx is good for EU countries TLD. For generic COM/NET I use http://internet.bs ,is pretty good. gandi was good too, but I was told that email is not free anymore with them. You can buy plain email service for a domain at Swisserland based https://www.infomaniak.com for 18 Euros a year (IMAP, 5 Emails)

Don't use Cloudflare https://expatcircle.com/cms/why-you-should-never-use-cloudfl...

If you do for domain price only, there are comparison sites. Just recently sombody posted one on YC. It may have been this one: https://tld-list.com/

Spaceship is owned by namecheap. Namecheap is supposed to be good too but I don't undertand why they would undercut their own prices.

EDIT: Cheapest non-bait registrar seems to be cosmotown with 8.99 USD. They seem to prevent C&P on their about page and one of their "partners" a German company, does not even have a webpage. Turing Crypto GmbH

I think I pass.

I would personally avoid namecheap if you're not based in the US. Back at the beginning of 2022 they cut off all clients from Russia without prior notice, giving everybody a couple of weeks to migrate to another registrar and/or hoster. This created quite a problem and added more work for oppositional news outlets and sites like ovdinfo that were helping people who got locked up for protesting against what was happening. Both groups had enough problems already. Fuck them; once bitten, twice shy.

Cloudflare, which I don't recommend, claims to sell domains "at cost" without any markup/profit. https://www.cloudflare.com/products/registrar/

If Cosmotown is 1 USD cheaper than cloudflare, they are losing money on every domain. They claim to "use AI tools to "minimize overhead".

Good luck with this registrar.

+1 for INWX. Reliable, reasonably cheap and domains is actually their core business rather than just something tacked on.

Recently did my research when moving around my own domain and settled on EasyDNS, as one that seemed most trustworthy (and with human support).

Though I do use CloudFlare for DNS and pages - I use EasyDNS purely as a registrar.

Have I got this right?

Cloudflare serves an SSL certificate for each site that it MITMs, and they fail to revoke it when the site leaves Cloudflare. A site "leaving" Cloudflare means that the site's DNS no longer points to Cloudflare IP addresses.

What's the problem? The departing site stops serving the Cloudflare certificate. Cloudflare is no longer the destination for visitors to the site, so it won't be serving the certificate either. The only way it could abuse the retained certificate would be if it controlled the site's DNS, so if $SITE_OWNER changes DNS provider, the retained certificate isn't a problem.

What did I miss?

That you're now one significantly weakened link closer to a breach. In itself this isn't a problem, but every time a provider thinks this isn't a problem because there needs to be other weaknesses elsewhere too, the validity of that logic is weakened.

He's just one DNS poisoning away from losing control of his website. Or a malicious DNS server used by a Wi-Fi network (e.g. public hotspots).

One DNS poisoning and cloudflare breach you mean?

Or one Cloudflare fuck-up. Either way, when I cut ties with a provider it's to cut ties with them, not leave them with a golden backdoor to my website.

You missed this line: “This is from a CDN who has a level of access unmatched by their rivals. CloudFlare are becoming the defualt DNS for browsers and have a VPN service.”

They’ve got a pretty large vector for intercepting real traffic from a substantial number of users.

I mean, if that is the concern, maybe don't give them a cert in the first place.

Lots of people use CloudFlare purely as a registar and DNS hoster because they sell domains at cost. Domains are quite expensive already for what they are. This is enough to trigger certificate issuance on your behalf. You don't have to use any add-on features. Maybe even just registering a domain is enough, I'm not sure. I certainly didn't "give them" any certificates, I don't have A/AAAA/CNAME records on several of my domains, and never enabled proxying traffic through the rest of them. The certs have been issued regardless.

I don't see this as a conspiracy theory, though. They want to sell you the whole package and don't want to support freeloaders like me who are only there for the "cheap" domains. That's reasonable, if unfortunate.

I hate how necessary CF is.

And by necessary you mean provide such a good service at a fair price that there's just no way around them, since everyone else is worse? If not, please explain how they are necessary? I run a large online service and am not using any of their products / services.

That's mostly marketing, large scale packet filtering on modern hardware is very solved by this point.

(2021)

Meh. While Cloudflare certainly isn't perfect...neither are their services provided by North Pole Elves. Doing Stuff for you is not free on their end.

And what is the betrayed-by-a-CF-held-cert scenario that you are worried about here? Given their size, and that you are not exactly a major bank, I'd say that CF has 1000X more skin in this game than you do, if the your-domain-name cert that they hold was put to malicious use.

Sounds 100% reasonable to me.

You want free L7 ddos protection... well that comes with some costs.

The costs of using cloudflare are well understood.

We get something for free but lose some control over our site, domain and data. CF gains insight into potentially valuable data like client information, traffic, attack and request patterns.

The costs and risks should be applicable as long as they enjoy the benefits but anything beyond a certain grace period doesn't sound reasonable.

I can understand if CF didn't prioritize it enough to spend development resources on revoking a cert but I don't see an upside for CF to continue keeping the certificate after a customer exits. They are unnecessarily taking on extra (reputation) risk if the still valid cert is compromised and used by someone else.

> I can understand if CF didn't prioritize it enough to spend development resources on revoking a cert but I don't see an upside for CF to continue keeping the certificate after a customer exits.

We have no idea if cloudflare retained the cert. The blog post is just claiming that cloudflare did not revoke the certificate and instead is just letting it expire naturally. (That said, i wouldn't be surprised if they retained it)

Potential upside for cloudflare is that if the client disabled ddos protection just temporarily to test something but intends to reenable it, this allows the reenable to happen instantly (assuming they kept the cert).

No one says that CF is retaining the cert lol, the article can't even show that they just know it hasn't been revoked, chances are CF just drops the certificate and deletes it when the user drops their usage, they don't go through the steps to also REVOKE the cert that used to be in use.

Which would be nice but honestly most browsers don't even do revocation checks so... ya

Reply on news.ycombinator.com