What sort of time period are the certificates issued for?
Universal SSL
31–40 of 250 posts
Re: Universal SSL
#32This is excellent news - one question though - what would a user on XP see when he accesses one of these sites?
Just tested using the WinXP+IE6 virtual machine from https://www.modern.ie/en-gb/virtualization-tools
Tested against: https://www.buro9.com/ , which is my own domain running behind CloudFlare using their SSL cert (it's a Pro account - my free accounts have not yet been enabled with the free SSL).
IE6 on WinXP accesses this without warning providing CloudFlare Apps are disabled.
If CloudFlare Apps are enabled, then IE6 gives a mixed-content warning but is fine with the SSL cert.
Caveat: This WinXP+IE6 version might not be precisely the same as whatever is in the wild and has never been updated. For reference WinXP is Service Pack 3, and IE6 is 6.0.2900.5512
Re: Universal SSL
#33I have very mixed feelings about this. Yes, on the one hand this is great news because a lot of websites who otherwise never would have bothered with SSL can now be protected from snooping or traffic manipulation on your local (possibly very insecure: your neighborhood Starbucks' wifi) network. On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you ar…
What they should do is require that the server has at least a self-signed certificate. They already support that but don't require it.
Re: Universal SSL
#34Earlier quoted context omitted.
A cert in your domain name. Something they could always do. As can anyone you've given control of your domain to. Domain validation is how most certificates are issued.
They could have done that by MITM the validation email you mean? EDIT: Ah, there are more options than email validation - my CA didn't offer those. Learned something, thanks.
No. Email is not the only supported method of domain validation.
See, for example, Comodo's documentation: https://support.comodo.com/index.php?/Default/Knowledgebase/...
Re: Universal SSL
#35Earlier quoted context omitted.
A cert in your domain name. Something they could always do. As can anyone you've given control of your domain to. Domain validation is how most certificates are issued.
They could have done that by MITM the validation email you mean? EDIT: Ah, there are more options than email validation - my CA didn't offer those. Learned something, thanks.
[deleted]
Re: Universal SSL
#36This'll be amazing for phishers and spear phishers - just use CloudFlare, and every user you're targeting will have the green padlock.
Tor will be amazing for child pornography and terrorists! Come on, vertex-four, every single thing in the universe you do can be turned upside down. TV == violence, telephone == annoying calls, etc. Please have a faith in humanity and give us some optimism. I'm sure SSL can be used for good as well!
It can be used for good - I never said it couldn't. I have no doubt that this will be used for much good. It's simply that it'll also be used for a fairly significant amount of bad, and it's worth pointing that out so that we can know that we might have to retrain users that "green padlock" does not necessarily equal "safe" (not that it ever did, but it was often a close enough approximation).
Re: Universal SSL
#37How can they automatically provision a certificate? Do they run or partner with a CA that doesn't require validation by the actual domain owner? Edit: If so, then what little trust still existed in the HTTPS PKI CA space just went out the window.
Domain validation has been available from multiple CAs by placing a root-level file on your webserver for years. If your domain points to a server controlled by a third party, they have always been able to pass domain validation.
Does cloudflare require A records or NS records to point to them before issuing the cert? I guess maybe that could work. I'm still a little skeptical about the whole no-interaction-required part.
Is there no way this is open to abuse? Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks? Maybe it's no different than regular automatic domain validation though.
Hopefully the backend that requests and retrieves new SSL certificates from the CA cannot be compromised.
Re: Universal SSL
#38I have very mixed feelings about this. Yes, on the one hand this is great news because a lot of websites who otherwise never would have bothered with SSL can now be protected from snooping or traffic manipulation on your local (possibly very insecure: your neighborhood Starbucks' wifi) network. On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you ar…
I agree, but a big part of Cloudflare's business is to manipulate the content between the origin server and the client. There is an element of trust when using Cloudflare.
Re: Universal SSL
#39I have very mixed feelings about this. Yes, on the one hand this is great news because a lot of websites who otherwise never would have bothered with SSL can now be protected from snooping or traffic manipulation on your local (possibly very insecure: your neighborhood Starbucks' wifi) network. On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you ar…
> this completely destroys the premise of HTTPS that you have an encrypted connection to the website you are visiting
It does nothing of the kind, it has always been the case that seeing the SSL padlock only informed you that the connection to whichever server you are communicating with is encrypted and nothing more.
Do you not recall the age of customer feedback pages hosted behind SSL that actually just sent plain text emails over the internet to the customer service email? SSL was never a guarantee that end-to-end communication was encrypted, and usually it was barely that.
What CF have done is to say that the jump to their servers can now be secured by SSL and that this works even for those who would not configure SSL (for either cost or complexity reasons). It's nothing more than that, it remains the case with SSL that you are trusting the site to support end-to-end encryption for sensitive data.
But what it does allow CF to do is partner with companies like Linode, Digital Ocean and so on, so that in effect when a user connects to CF via an SSL connection the entirety of the communication could occur within the trusted CF+Partner network and none of the traffic would be plain text over the internet. It's a foundation to build upon.
Re: Universal SSL
#40Earlier quoted context omitted.
Domain validation has been available from multiple CAs by placing a root-level file on your webserver for years. If your domain points to a server controlled by a third party, they have always been able to pass domain validation.
Does cloudflare require A records or NS records to point to them before issuing the cert? I guess maybe that could work. I'm still a little skeptical about the whole no-interaction-required part. Is there no way this is open to abuse? Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks? Maybe it's no different than regular automatic domain validation though. Hopefully t…
> Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks?
You need to point the your domain to CloudFlare nameserver. I don't think you can do that unless you actually control the domain.