Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Universal SSL

blog.cloudflare.com

Post reply on HN
Print view View original

91–100 of 250 posts

Re: Universal SSL

#91

Post by daveasdf »

This was indeed a pleasant surprise when I logged into my CloudFlare account.

What intrigues me is that CloudFlare missed an opportunity to allow secure self-signed certificates.

The new CloudFlare SSL setup allows the origin server to present to CloudFlare's servers either (i) an unverified self-signed certificates; or (ii) a certificate signed by a CA. Neither provides great security. In the former case, a MITM can trivially generate a new self-signed certificate. History has shown the latter case is also problematic, as there have been several events where CAs have generated invalid keys [1].

What would be nice is if I could generate a self-signed certificate and upload the fingerprint(s) to CloudFlare. CloudFlare would could then verify the fingerprint when connecting to my origin server, without needing to trust a CA.

Am I missing anything obvious as to why this wouldn't be as secure (or more secure) than the two options CloudFlare has introduced?

[1]: For instance: http://googleonlinesecurity.blogspot.com.au/2013/12/further-...

Re: Universal SSL

#92

Post by switch007 »

vader1 wrote: post #75
buro9 wrote: post #39

Earlier quoted context omitted.

> this completely destroys the premise of HTTPS that you have an encrypted connection to the website you are visiting It does nothing of the kind, it has always been the case that seeing the SSL padlock only informed you that the connection to whichever server you are communicating with is encrypted and nothing more. Do you not recall the age of customer feedback pages hosted behind SSL that actually just sent plain…

Of course using HTTPS is no guarantee that the site doesn't leak your data in any other way. But never before has it been this easy to create a false sense of security: give the impression that connections to your site are encrypted, while in reality it's plaintext for half of the route. I think this will ultimately dilute the value of HTTPS as we know it, and can only hope that it will lead to the adoption of better…

I would bet there are many, many load-balancers terminating SSL and then proxying plain HTTP to web servers over a VLAN.

Re: Universal SSL

#93

Post by deanclatworthy »

I just got the popup, clicked "okay" and when I go to "Cloudflare settings", it's still only available to select SSL options for the paid plans.

For those who haven't yet seen the popup there's a bit more info here: https://www.cloudflare.com/ssl#universal_ssl

It's a pity that I got the message saying it was available on my account, when the setting is not yet activated :)

Re: Universal SSL

#94

Post by edent »

Interestingly, I just tried to visit one of my CloudFlare protected sites. Shoving https in front of the URL results in this error in Firefox & Chrome.

dabr.eu uses an invalid security certificate. The certificate is only valid for the following names: ssl2000.cloudflare.com, .redpitt.mobi, redpitt.mobi, cloudflare.com, .cloudflare.com

So I assume it isn't quite as seamless / automated as it makes out?

edit ah - a little further reading says it will roll out over the next few days.

Re: Universal SSL

#95

Post by jgrahamc »

edent wrote: post #94

Interestingly, I just tried to visit one of my CloudFlare protected sites. Shoving https in front of the URL results in this error in Firefox & Chrome. dabr.eu uses an invalid security certificate. The certificate is only valid for the following names: ssl2000.cloudflare.com, .redpitt.mobi, redpitt.mobi, cloudflare.com, .cloudflare.com So I assume it isn't quite as seamless / automated as it makes out? edit ah - a li…

Your cert hasn't been issued yet. We are in the processing of issuing 2 million certs. You got a default cert that's sort of a 'catch all'. When that goes away your domain will have been issued a real cert.

Re: Universal SSL

#96

Post by jgrahamc »

daveasdf wrote: post #91

This was indeed a pleasant surprise when I logged into my CloudFlare account. What intrigues me is that CloudFlare missed an opportunity to allow secure self-signed certificates. The new CloudFlare SSL setup allows the origin server to present to CloudFlare's servers either (i) an unverified self-signed certificates; or (ii) a certificate signed by a CA. Neither provides great security. In the former case, a MITM can…

Expect a further announcement down the line. We are working on solutions similar to those that you propose.

Re: Universal SSL

#97

Post by feld »

LordIllidan wrote: post #15
vertex-four wrote: post #10

This'll be amazing for phishers and spear phishers - just use CloudFlare, and every user you're targeting will have the green padlock.

Given that ssl certificates are free nowadays (e.g. https://www.startssl.com/ ), how was this not an issue before?

startssl is convenient but they force you to pay to revoke your certificates. I've heard rumors of startssl being close to getting on blacklists due to this behavior -- tons of certs were never revoked after heartbleed, for example.

Re: Universal SSL

#98

Post by edent »

jgrahamc wrote: post #95
edent wrote: post #94

Interestingly, I just tried to visit one of my CloudFlare protected sites. Shoving https in front of the URL results in this error in Firefox & Chrome. dabr.eu uses an invalid security certificate. The certificate is only valid for the following names: ssl2000.cloudflare.com, .redpitt.mobi, redpitt.mobi, cloudflare.com, .cloudflare.com So I assume it isn't quite as seamless / automated as it makes out? edit ah - a li…

Your cert hasn't been issued yet. We are in the processing of issuing 2 million certs. You got a default cert that's sort of a 'catch all'. When that goes away your domain will have been issued a real cert.

Faster man! Faster! :-)

Thanks for doing this - such an excellent initiative.

Re: Universal SSL

#99

Post by jgrahamc »

edent wrote: post #98
jgrahamc wrote: post #95

Earlier quoted context omitted.

Your cert hasn't been issued yet. We are in the processing of issuing 2 million certs. You got a default cert that's sort of a 'catch all'. When that goes away your domain will have been issued a real cert.

Faster man! Faster! :-) Thanks for doing this - such an excellent initiative.

Since you ask so nicely I had your domain bumped up in the queue.

Re: Universal SSL

#100

Post by pdkl95 »

jgrahamc wrote: post #85
pdkl95 wrote: post #78

First, let me say that the aggressive approach to actually making encryption happen that CloudFlare has been pushing recently is very commendable. The hard part about finally retiring the old plaintext protocols we currently are stuck with is critical mass - nobody sees the point when plaintext seems to "work just fine". The various steps CloudFlare has taken to encourage SSL will go a long way towards reversing that…

It seems to me that CloudFlare is positioning themselves as another Google or Facebook, where a key feature of their business is that they get to track the web history of a large portion of internet users. CloudFlare's business model is not offering a free service and figure out how to make money. It's getting people to pay us money and those people are our actual customers who run web sites: https://www.cloudflare.c…

I get that stuff - their transparency report is, of course, also very encouraging and another boost to their reputation. (I'll mention that they have more "warrant canaries" than I was aware of previously, which IS a good sign, though the utility of such statements is somewhat uncertain)

My concern is that the single point of failure still exists. CloudFlare may have the best of intentions, but they aren't going to be able to stop a national security letter or other threat. Also, attitudes (and CEO/BoD) can change. From a purely engineering point of view, one good hack is what stands between those valuable logs or ssl certs and the various parties that would love to have them. Contrast this with the old manufacturing practice of always requiring a second source for key parts or services, though the analogy isn't perfect.

Post reply on HN