Live data from Hacker News

Universal SSL

blog.cloudflare.com

21–30 of 250 posts

Re: Universal SSL

#21

My website that is behind Cloudflare on the free plan, has suddenly started giving me an error in Google Chrome. The error is as follows: You cannot visit mysite.com right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later. The website has been running for over a year with no problems behind Cloudflare, so I'm assuming this new rollout is the cau…

Nope, that's not something anything we did would cause. We're not adding HSTS (yet).

Re: Universal SSL

#22

My website that is behind Cloudflare on the free plan, has suddenly started giving me an error in Google Chrome. The error is as follows: You cannot visit mysite.com right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later. The website has been running for over a year with no problems behind Cloudflare, so I'm assuming this new rollout is the cau…

Edit Edit: I can still access the site using the really long aws URL as my site is hosted on S3, so it really does seem the problem is with Cloudflare. (Not a network specialist, so I could be totally wrong about this)

Re: Universal SSL

#23
I have very mixed feelings about this. Yes, on the one hand this is great news because a lot of websites who otherwise never would have bothered with SSL can now be protected from snooping or traffic manipulation on your local (possibly very insecure: your neighborhood Starbucks' wifi) network.

On the other hand, this completely destroys the premise of HTTPS that you have an encrypted connection to the website you are visiting. If this catches on big time, seeing the padlock will only tell you that you have an encrypted connection to Cloudflare's network, and no way of knowing if the traffic is still encrypted beyond that, or that it's flowing in plaintext between Cloudflare and the actual target server. Worse, you will have absolutely no way of knowing if the content you're seeing is what the target server originally sent, or that it has been manipulated (or wiretapped) by Cloudflare itself or any of the other hops while en route.

If you are going to use this, just keep in mind that you're giving Cloudflare - a US company subject to the Patriot Act and the whole shebang of 3-letter agencies - the ability to collect, intercept, store, and manipulate every single byte of traffic sent between your users and your servers.

Re: Universal SSL

#24

Does cloudflare have the ability to issue certificates that are trusted by major browsers? Or will the cloudflare issued certificates simply give users an untrusted CA warning?

Yes, we've partnered with multiple CAs that allow us to issue certs trusted by virtually every browser.

Re: Universal SSL

#25

My website that is behind Cloudflare on the free plan, has suddenly started giving me an error in Google Chrome. The error is as follows: You cannot visit mysite.com right now because the website uses HSTS. Network errors and attacks are usually temporary, so this page will probably work later. The website has been running for over a year with no problems behind Cloudflare, so I'm assuming this new rollout is the cau…

Nope, that's not something anything we did would cause. We're not adding HSTS (yet).

Strange, I went to bed last night and everything was working and it was just a plain HTTP site sitting behind Cloudflare. Then I get up this morning and I'm getting SSL errors, I'm not sure where to go from here then.

Re: Universal SSL

#26
post #20

How can they automatically provision a certificate? Do they run or partner with a CA that doesn't require validation by the actual domain owner? Edit: If so, then what little trust still existed in the HTTPS PKI CA space just went out the window.

Yes, we partnered with multiple CAs that are trusted by virtually every browser.

Re: Universal SSL

#27
post #4

This is great, but just two concerns. CloudFlare just generated itself certs for how many domains? And you don't really have a secure connection but the browser will report that you do.

It sure reads as they genereated 2mio+ certs - that's probably why they thank GlobalSign and Comodo in the blog post. I'm not sure how I should feel, if company x (where I am a registered but non-paying customer in their free tier) gets a cert in my name withouth asking before.

A cert in your domain name. Something they could always do. As can anyone you've given control of your domain to. Domain validation is how most certificates are issued.

Re: Universal SSL

#28
post #20

How can they automatically provision a certificate? Do they run or partner with a CA that doesn't require validation by the actual domain owner? Edit: If so, then what little trust still existed in the HTTPS PKI CA space just went out the window.

Yes, we partnered with multiple CAs that are trusted by virtually every browser.

Isn't provisioning certs without at least a simple human interaction from the domain holder against CA rules?

Re: Universal SSL

#29
post #20

How can they automatically provision a certificate? Do they run or partner with a CA that doesn't require validation by the actual domain owner? Edit: If so, then what little trust still existed in the HTTPS PKI CA space just went out the window.

Domain validation has been available from multiple CAs by placing a root-level file on your webserver for years. If your domain points to a server controlled by a third party, they have always been able to pass domain validation.

Re: Universal SSL

#30

Earlier quoted context omitted.

It sure reads as they genereated 2mio+ certs - that's probably why they thank GlobalSign and Comodo in the blog post. I'm not sure how I should feel, if company x (where I am a registered but non-paying customer in their free tier) gets a cert in my name withouth asking before.

A cert in your domain name. Something they could always do. As can anyone you've given control of your domain to. Domain validation is how most certificates are issued.

They could have done that by MITM the validation email you mean?

EDIT: Ah, there are more options than email validation - my CA didn't offer those. Learned something, thanks.

Post reply on HN