Good job cloudflare for finally keeping up with the industry. Cloudfront, for example, already supports universal ssl and SNI
Cloudflare has offered SSL & SNI for paid customers for ages. You're missing the point.
Universal SSL
161–170 of 250 posts
Re: Universal SSL
#162Earlier quoted context omitted.
I think this is a good idea as well. In their blog post they discuss how "Full SSL" is much better security than "Flexible SSL", but by not making it a requirement a lot of people won't bother with it.
"Full SSL" is still useless against an advanced attacker as it does absolutely nothing to prevent MITM. Only "Strict SSL" does, which makes sure it's a valid CA-signed certificate. What we need (and what myself and others have requested) is Full SSL with fingerprint checking so you can keep security with a self-signed cert. I honestly think CF should remove flexible SSL and full SSL as options - they're just too vuln…
Will Cloudflare take any self-signed certificate in that scenario? I assumed you'd have to confirm the fingerprint (essentially pinning it) from within Cloudflare interface.
Re: Universal SSL
#163Earlier quoted context omitted.
> A self-signed cert is about as secure as no cert at all. It protects enormously against a casual attacker who is able to sniff network traffic but not MITM you.
This is the nail-clipper defense. For cases where a terrorist might take over a plane by threatening to give people tiny cuts or jabs, taking away nail clippers 'protects enormously'. How often have you encountered read-only network access? It doesn't happen in reality; even the middle hop in a route has total control over the flow of traffic and thus can terminate it and mitm on reconnect. In any case, confidentiali…
> How often have you encountered read-only network access?
Public wireless points (i.e. Firesheep), any network with a hub instead of a switch...
Re: Universal SSL
#164Interestingly, I just tried to visit one of my CloudFlare protected sites. Shoving https in front of the URL results in this error in Firefox & Chrome. dabr.eu uses an invalid security certificate. The certificate is only valid for the following names: ssl2000.cloudflare.com, .redpitt.mobi, redpitt.mobi, cloudflare.com, .cloudflare.com So I assume it isn't quite as seamless / automated as it makes out? edit ah - a li…
Your cert hasn't been issued yet. We are in the processing of issuing 2 million certs. You got a default cert that's sort of a 'catch all'. When that goes away your domain will have been issued a real cert.
Not trying to diminish the value of what you're doing, but, who gave you(Cloudflare) permission to issue SSL certificates for my domains, hypothetically speaking ofcourse? Shouldn't that be an opt-in process?
Re: Universal SSL
#165I have very mixed feelings about this. Yes, on the one hand this is great news because a lot of websites who otherwise never would have bothered with SSL can now be protected from snooping or traffic manipulation on your local (possibly very insecure: your neighborhood Starbucks' wifi) network. On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you ar…
"On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you are visiting ." Yes, you do. You are visiting a website that CloudFlare is serving, and you have encryption to that. Other replies have already gone into how HTTPS never guaranteed anything about what happened after that, but I think that's the wrong POV. What HTTPS guarantees is that one of the…
>> "On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you are visiting."
>> Yes, you do. You are visiting a website that CloudFlare is serving, and you have encryption to that.
Total newbie here.
Since CloudFlare (and likewise any other CDN) is hosting many websites, how do I know the information served originated from the intended website and not from another one CloudFlare is hosting?
We have been told to look at the browser's address bar to make sure domain belongs to the intended website (e.g., citibank.com and not citibank.another.com). With browser pulling information from CloudFlare, and often over twenty others listed by NoScript and Ghostery on practically every website today, what precautions should I be taking?
Re: Universal SSL
#166Will users be able to download their private keys for the provisioned cert? If not, would CloudFlare ever consider provisioning free SSL certs for non-CloudFlare customers (i.e. let us uploade our crt file and you have your CAs sign it)? We desperately need an alternative to StartCom, since many devs don't trust them[1]. I've suggested AOL in another thread[2], but so far I can't find anyone who works there to talk t…
A private key should never be given to a third party (preferably not even a trusted one), and downloading the private key generated by CloudFlare would also negate the "private" feature. Furthermore, you don't upload a crt (certficate) file for a CA to sign, because that is the result of a CA's signature. You upload a certificate signing request (csr) after having generated a private key on the same machine where the key/certficate will be used; this way you are sure you have never lost control over the private key.
With respect to StartCom I don't really see the problem or why anyone would step up to offer something better for free. Certificates are a money making business and with StartCom you get the security you pay for ...
Re: Universal SSL
#167I just got the popup, clicked "okay" and when I go to "Cloudflare settings", it's still only available to select SSL options for the paid plans. For those who haven't yet seen the popup there's a bit more info here: https://www.cloudflare.com/ssl#universal_ssl It's a pity that I got the message saying it was available on my account, when the setting is not yet activated :)
Yes, sorry about that. We're rushing to set up certificates for everyone who uses CloudFlare.
Re: Universal SSL
#168I have very mixed feelings about this. Yes, on the one hand this is great news because a lot of websites who otherwise never would have bothered with SSL can now be protected from snooping or traffic manipulation on your local (possibly very insecure: your neighborhood Starbucks' wifi) network. On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you ar…
Thank you for pointing out that this is the now-equivalent of the clipper chip. I loved the 90's, I get to wear my parachute pants again, Yay!
Re: Universal SSL
#169Once IPv6 is a bit more popular, will CloudFlare use a unique IP per customer to get around SNI or will it still be used on IPv6? It seems a bit like NAT; something that can safely die once IPv4 is gone.
So, you want NAT to die, but apparently you forget that NAT is what protects most domestic computers from intrusion, not anti-virus or software firewalls.
It will be fun...
Re: Universal SSL
#170Earlier quoted context omitted.
I guess you're right about that, but it still feels a bit weird that a third party can just allocate a private key and a valid certificate without the actual owner of the domain requesting it.
If you've given up control of the DNS on your domain to a third party, they can do whatever they want with that domain - they ultimately control email, web, and any other services on that domain. so if you use cloudflare, you've already given up that control and trust them completely with your domain. This is what makes me hesitant about using cloudflare or recommending it to clients; you give up a lot of control ove…
That's always going to be true at some level—even if you're hosting DNS yourself. I self-host the DNS for many of my domains on a Linode VPS. If Linode decides that they don't like me (or they just make a mistake) and re-allocates my IP addresses to someone else, they could set up their own DNS server to direct my domains however they please. However, I trust Linode to not do this, based on their track record and reputation.
You're always at the mercy of at least one vendor, unless you own your own block of IP addresses and advertise it via BGP (and even then, someone could make their own malicious advertisement of your IP block).
You can't eliminate the risk. At some point, you have to set the threshold for what risk you consider acceptable. For many organizations, using Cloudflare provides enough benefit to outweigh the slightly higher risk of something going wrong.