gurrone

I think there was some rumors that they are - or are planing - to offer certificates signed by a private Cloudflare CA exactly for the purpose of encrypting the traffic to the backend.

Maybe availability but as long as you generate the private key part and paste your CSR on the website they can at worst revoke your certificate. So from a security perspective they're not worse then the others.

They lowered that to 10 lately. I was also surprised but I guess they pissed of others in the biz. Usually I see it limited to 40 by the comercial options.

On the server side you've to make sure you run a decent nginx/apache with OCSP stapling support. Their responders are slow.

while I in general also disagree with the whole CA thing one has to admit that running a CA is not for free. That setting up the auditing, buying a HSM, running the interfaces and so on. And last but not least running the CRL/OCSP infrastructure. From my point of view the main part you pay a good CA for is that they run the OCSP service. Though with OCSP stapling that burden is a bit relaxed.