51–60 of 250 posts
Earlier quoted context omitted.
Nope, that's not something anything we did would cause. We're not adding HSTS (yet).
Strange, I went to bed last night and everything was working and it was just a plain HTTP site sitting behind Cloudflare. Then I get up this morning and I'm getting SSL errors, I'm not sure where to go from here then.
What prevents me from doing this MITM attack in (for example) a public wifi: I add a domain I don't own (example.com) to my cloudflare account. Then I point a hostname (www.example.com) to an IP address I own (1.2.3.4).
From what I understand, cloudflare now serves HTTPS for this domain through their proxies. I can easily find out the IP of one of those by querying the nameserver they assiged me by doing "dig www.example.com @gene.ns.cloudflare.com".
Now when I spoof DNS responses, I can return one of those IPs. The traffic will go to cloudflare. They have a signed certificate for that domain and the traffic gets forwarded to my IP (1.2.3.4).
Maybe I'm missing something, but I tried the http part of this and proxying seems to work before cloudflare comfirmed that the (in the example) example.com domains nameserver actually points to cloudflares nameservers.
Earlier quoted context omitted.
Does cloudflare require A records or NS records to point to them before issuing the cert? I guess maybe that could work. I'm still a little skeptical about the whole no-interaction-required part. Is there no way this is open to abuse? Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks? Maybe it's no different than regular automatic domain validation though. Hopefully t…
> Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks? You need to point the your domain to CloudFlare nameserver. I don't think you can do that unless you actually control the domain.
Can I pin the certificate from PaaS providers for .herokuapp.com or .rhcloud.com to enable "Full SSL" (Strict) on CF?
Although the SSL support for custom domains is a paid feature for most PaaS providers, this won't be true now if this is possible.
Earlier quoted context omitted.
Strange, I went to bed last night and everything was working and it was just a plain HTTP site sitting behind Cloudflare. Then I get up this morning and I'm getting SSL errors, I'm not sure where to go from here then.
Are you using the HTTPS Everywhere extension, by any chance?
Edit: formatting
Great initiative, minor drawbacks such as up to 20% of the traffic wouldn't apply due to their use of SNI: "Globally, more than 80% of requests come from modern browsers, and that percentage is growing quickly." EDIT: Mixed content on that page (within the embedded map at https://cloudflare.github.io/sni-visualization/ )
EDIT: Won't work: You need to verify that you own the domain by pointing your NS records to cloudflares nameservers. What prevents me from doing this MITM attack in (for example) a public wifi: I add a domain I don't own (example.com) to my cloudflare account. Then I point a hostname (www.example.com) to an IP address I own (1.2.3.4). From what I understand, cloudflare now serves HTTPS for this domain through their p…
Earlier quoted context omitted.
> Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks? You need to point the your domain to CloudFlare nameserver. I don't think you can do that unless you actually control the domain.
I guess you're right about that, but it still feels a bit weird that a third party can just allocate a private key and a valid certificate without the actual owner of the domain requesting it.
Earlier quoted context omitted.
Yes, we partnered with multiple CAs that are trusted by virtually every browser.
Isn't provisioning certs without at least a simple human interaction from the domain holder against CA rules?
This is excellent news - one question though - what would a user on XP see when he accesses one of these sites?
Just tested using the WinXP+IE6 virtual machine from https://www.modern.ie/en-gb/virtualization-tools Tested against: https://www.buro9.com/ , which is my own domain running behind CloudFlare using their SSL cert (it's a Pro account - my free accounts have not yet been enabled with the free SSL). IE6 on WinXP accesses this without warning providing CloudFlare Apps are disabled. If CloudFlare Apps are enabled, then IE…