My website that is behind Cloudflare on the free plan, has suddenly started giving me an error in Google Chrome. The error is as follows: You cannot visit mysite.com right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later. The website has been running for over a year with no problems behind Cloudflare, so I'm assuming this new rollout is the cau…
Universal SSL
21–30 of 250 posts
Re: Universal SSL
#22My website that is behind Cloudflare on the free plan, has suddenly started giving me an error in Google Chrome. The error is as follows: You cannot visit mysite.com right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later. The website has been running for over a year with no problems behind Cloudflare, so I'm assuming this new rollout is the cau…
Re: Universal SSL
#23On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you are visiting. If this catches on big time, seeing the padlock will only tell you that you have an encrypted connection to Cloudflare's network, and no way of knowing if the traffic is still encrypted beyond that, or that it's flowing in plaintext between Cloudflare and the actual target server. Worse, you will have absolutely no way of knowing if the content you're seeing is what the target server originally sent, or that it has been manipulated (or wiretapped) by Cloudflare itself or any of the other hops while en route.
If you are going to use this, just keep in mind that you're giving Cloudflare - a US company subject to the Patriot Act and the whole shebang of 3-letter agencies - the ability to collect, intercept, store, and manipulate every single byte of traffic sent between your users and your servers.
Re: Universal SSL
#24Does cloudflare have the ability to issue certificates that are trusted by major browsers? Or will the cloudflare issued certificates simply give users an untrusted CA warning?
Re: Universal SSL
#25My website that is behind Cloudflare on the free plan, has suddenly started giving me an error in Google Chrome. The error is as follows: You cannot visit mysite.com right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later. The website has been running for over a year with no problems behind Cloudflare, so I'm assuming this new rollout is the cau…
Nope, that's not something anything we did would cause. We're not adding HSTS (yet).
Re: Universal SSL
#26How can they automatically provision a certificate? Do they run or partner with a CA that doesn't require validation by the actual domain owner? Edit: If so, then what little trust still existed in the HTTPS PKI CA space just went out the window.
Re: Universal SSL
#27This is great, but just two concerns. CloudFlare just generated itself certs for how many domains? And you don't really have a secure connection but the browser will report that you do.
It sure reads as they genereated 2mio+ certs - that's probably why they thank GlobalSign and Comodo in the blog post. I'm not sure how I should feel, if company x (where I am a registered but non-paying customer in their free tier) gets a cert in my name withouth asking before.
Re: Universal SSL
#28How can they automatically provision a certificate? Do they run or partner with a CA that doesn't require validation by the actual domain owner? Edit: If so, then what little trust still existed in the HTTPS PKI CA space just went out the window.
Yes, we partnered with multiple CAs that are trusted by virtually every browser.
Re: Universal SSL
#29How can they automatically provision a certificate? Do they run or partner with a CA that doesn't require validation by the actual domain owner? Edit: If so, then what little trust still existed in the HTTPS PKI CA space just went out the window.
Re: Universal SSL
#30Earlier quoted context omitted.
It sure reads as they genereated 2mio+ certs - that's probably why they thank GlobalSign and Comodo in the blog post. I'm not sure how I should feel, if company x (where I am a registered but non-paying customer in their free tier) gets a cert in my name withouth asking before.
A cert in your domain name. Something they could always do. As can anyone you've given control of your domain to. Domain validation is how most certificates are issued.
EDIT: Ah, there are more options than email validation - my CA didn't offer those. Learned something, thanks.