Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Universal SSL

blog.cloudflare.com

Post reply on HN
Print view View original

41–50 of 250 posts

Re: Universal SSL

#41

Post by escapologybb »

eastdakota wrote: post #21
escapologybb wrote: post #12

My website that is behind Cloudflare on the free plan, has suddenly started giving me an error in Google Chrome. The error is as follows: You cannot visit mysite.com right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later. The website has been running for over a year with no problems behind Cloudflare, so I'm assuming this new rollout is the cau…

Nope, that's not something anything we did would cause. We're not adding HSTS (yet).

Okay, really seems like it is something to do with Cloudflare. When I pause Cloudflare the site loads really quickly every single time, then when I resume using Cloudflare I get the same error in Chrome. In Firefox I'm told by an Cloudflare error page my web server is down, when it's demonstrably not.

This is really not my area of expertise, but does it seem to anybody else like this is something to do with the Cloudflare SSL rollout?

Re: Universal SSL

#42

Post by nirvdrum »

nknighthb wrote: post #13
spacefight wrote: post #2

Great initiative, minor drawbacks such as up to 20% of the traffic wouldn't apply due to their use of SNI: "Globally, more than 80% of requests come from modern browsers, and that percentage is growing quickly." EDIT: Mixed content on that page (within the embedded map at https://cloudflare.github.io/sni-visualization/ )

If your target audience is in the west, it's more like 5-10%, and the problem there is going away. XP and Android 2.x are dropping off pretty quickly.

The larger problem I had was with non-interactive browsers. E.g., GitHub changed their downloads server to use SNI and overnight a bunch of scripts I had using wget on Ubuntu 12.04 (a distribution supported until 2017) stopped working. Java 6 doesn't support SNI, so you need to watch your API stats. And I seem to recall using versions of Python and Ruby that also didn't support it.

Re: Universal SSL

#43

Post by jgrahamc »

escapologybb wrote: post #41
eastdakota wrote: post #21

Earlier quoted context omitted.

Nope, that's not something anything we did would cause. We're not adding HSTS (yet).

Okay, really seems like it is something to do with Cloudflare. When I pause Cloudflare the site loads really quickly every single time, then when I resume using Cloudflare I get the same error in Chrome. In Firefox I'm told by an Cloudflare error page my web server is down, when it's demonstrably not. This is really not my area of expertise, but does it seem to anybody else like this is something to do with the Cloud…

Contact CloudFlare support?

Re: Universal SSL

#44

Post by [deleted] »

0x0 wrote: post #37
nknighthb wrote: post #29

Earlier quoted context omitted.

Domain validation has been available from multiple CAs by placing a root-level file on your webserver for years. If your domain points to a server controlled by a third party, they have always been able to pass domain validation.

Does cloudflare require A records or NS records to point to them before issuing the cert? I guess maybe that could work. I'm still a little skeptical about the whole no-interaction-required part. Is there no way this is open to abuse? Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks? Maybe it's no different than regular automatic domain validation though. Hopefully t…

[deleted]

Re: Universal SSL

#45

Post by scintill76 »

buro9 wrote: post #39
vader1 wrote: post #23

I have very mixed feelings about this. Yes, on the one hand this is great news because a lot of websites who otherwise never would have bothered with SSL can now be protected from snooping or traffic manipulation on your local (possibly very insecure: your neighborhood Starbucks' wifi) network. On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you ar…

> this completely destroys the premise of HTTPS that you have an encrypted connection to the website you are visiting It does nothing of the kind, it has always been the case that seeing the SSL padlock only informed you that the connection to whichever server you are communicating with is encrypted and nothing more. Do you not recall the age of customer feedback pages hosted behind SSL that actually just sent plain…

The centralization argument still has merit. If this catches on big time, there's only one company to coerce/compromise, to backdoor a bunch of services at once.

Arguably the CA/ISP structure is like this already, but this may be worse.

Re: Universal SSL

#46

Post by rjaco31 »

spacefight wrote: post #28
eastdakota wrote: post #26

Earlier quoted context omitted.

Yes, we partnered with multiple CAs that are trusted by virtually every browser.

Isn't provisioning certs without at least a simple human interaction from the domain holder against CA rules?

Well having a website hosted on Cloudflare implies that you had more interaction than most CAs will ever ask you to get a certificate, that is beside giving them the money.

Re: Universal SSL

#47

Post by ck2 »

Becoming a single point of massive exploit, they need a warrant canary asap.

Not only for US Government but other governments that heavily monitor their citizens on the internet and want to see what is going on so they can imprison or execute their people for what they say.

Re: Universal SSL

#48

Post by cynix »

The majority of CloudFlare's IP addresses are blocked by China's great firewall, which means CloudFlare is out of the question if you expect that your website will be visited by Chinese users.

Re: Universal SSL

#49

Post by escapologybb »

jgrahamc wrote: post #43
escapologybb wrote: post #41

Earlier quoted context omitted.

Okay, really seems like it is something to do with Cloudflare. When I pause Cloudflare the site loads really quickly every single time, then when I resume using Cloudflare I get the same error in Chrome. In Firefox I'm told by an Cloudflare error page my web server is down, when it's demonstrably not. This is really not my area of expertise, but does it seem to anybody else like this is something to do with the Cloud…

Contact CloudFlare support?

Already done that, not heard back yet. Mildly panicking and thought the Hive Mind might be able to help.

Re: Universal SSL

#50

Post by jgrahamc »

ck2 wrote: post #47

Becoming a single point of massive exploit, they need a warrant canary asap. Not only for US Government but other governments that heavily monitor their citizens on the internet and want to see what is going on so they can imprison or execute their people for what they say.

https://www.cloudflare.com/transparency
Post reply on HN