CloudFlare enabling free SSL by mid-October
blog.cloudflare.com
CloudFlare enabling free SSL by mid-October
1–10 of 66 posts
Re: CloudFlare enabling free SSL by mid-October
#2Are there more actual implementation details somewhere? Sounds like selecting the ssl context based on the clients SNI request. This (obviously) would predicate client SNI support, as opposed to anycast IPs or similar.
Re: CloudFlare enabling free SSL by mid-October
#3CloudFlare is the coolest free CDN out there.
Re: CloudFlare enabling free SSL by mid-October
#4Are there more actual implementation details somewhere? Sounds like selecting the ssl context based on the clients SNI request. This (obviously) would predicate client SNI support, as opposed to anycast IPs or similar.
CloudFlare's CEO says that free SSL will use SNI with ipv4 [1] and possibly non-SNI with ipv6 [2]. A CloudFlare engineer has discussed splitting the SSL handshake between servers so their many edge nodes don't need to keep customer secret keys in memory [3]. However, this sounds slightly different than the lazy loading behavior in the blog post.
[1] https://news.ycombinator.com/item?id=7910849
[2] https://twitter.com/eastdakota/status/478369486643658754
[3] http://www.slideshare.net/cloudflare/running-secure-server-s...
Re: CloudFlare enabling free SSL by mid-October
#5Most of the websites wont encrypt the link from Cloudflare to the server, ultimately defeating the purpose of SSL aside from a better search ranking.
Re: CloudFlare enabling free SSL by mid-October
#6Most of the websites wont encrypt the link from Cloudflare to the server, ultimately defeating the purpose of SSL aside from a better search ranking.
Could you elaborate on this. My impression was that connections between data centres (e.g. in the case of using an EC2 instance with Cloudflare) were already very secure and therefore do not require SSL.
Re: CloudFlare enabling free SSL by mid-October
#7Most of the websites wont encrypt the link from Cloudflare to the server, ultimately defeating the purpose of SSL aside from a better search ranking.
Could you elaborate on this. My impression was that connections between data centres (e.g. in the case of using an EC2 instance with Cloudflare) were already very secure and therefore do not require SSL.
Depends what you're trying to protect against. Those links are notably very insecure against the NSA.
Re: CloudFlare enabling free SSL by mid-October
#8Most of the websites wont encrypt the link from Cloudflare to the server, ultimately defeating the purpose of SSL aside from a better search ranking.
It's not a problem if those connections use self-signed certificates, right? If that's the case, then setting up SSL from CloudFlare to your servers should be pretty easy.
Re: CloudFlare enabling free SSL by mid-October
#9Earlier quoted context omitted.
Could you elaborate on this. My impression was that connections between data centres (e.g. in the case of using an EC2 instance with Cloudflare) were already very secure and therefore do not require SSL.
Depends what you're trying to protect against. Those links are notably very insecure against the NSA.
Right. If there were a diagram of this architecture, the NSA would scribble "SSL added and removed here" with a smiley face[1]. It's arguably even worse, since the traffic between CloudFlare and the origin server would be traveling in the clear on the public Internet, as opposed to in the clear within Google's private network.
[1] http://www.washingtonpost.com/world/national-security/nsa-in...
Re: CloudFlare enabling free SSL by mid-October
#10Most of the websites wont encrypt the link from Cloudflare to the server, ultimately defeating the purpose of SSL aside from a better search ranking.
It's not a problem if those connections use self-signed certificates, right? If that's the case, then setting up SSL from CloudFlare to your servers should be pretty easy.
It would be free, but not necessarily easy, as it would still entail configuring your web server to use SSL, and that might not even be an option if you're using shared hosting.
(Aside: self signed certs don't protect the connection from active attacks unless CloudFlare pins the cert. I'm mainly concerned with passive eavesdropping though.)