4 ms·

I don't think that's true anymore, see https://www.cloudflare.com/ssl https://www.cloudflare.com/ssl ("Full SSL" and "Full SSL (strict)" options)

incarnate 11y ago
Ah, but to use the Full SSL options you need an SSL on your origin server (which CloudFlare doesn't provide for free)!
- BillinghamJ 11y ago
  That certificate can be self signed.
  - mehrdada 11y ago
    In which case, it can be easily MITM'd by an attacker sitting between CloudFlare and your server, which makes it only slightly better than plain HTTP. It would have been great if CloudFlare let the user to upload and pin a specific self-signed certificate that it could then validate to prevent such attacks.
  - gurrone 11y ago
    I think there was some rumors that they are - or are planing - to offer certificates signed by a private Cloudflare CA exactly for the purpose of encrypting the traffic to the backend.
johncolanduoni 11y ago
Unfortunately, this means you either have to use a self-signed cert which CloudFlare will not verify at all (meaning it can be MITMed) or use one signed by a trusted CA... which brings you back to square one.
- leni536 11y ago
  > self-signed cert which CloudFlare will not verify at all. Why would they do that? I never used this feature of CloudFlare, but it would be only logical to require you to upload the cert so they can verify against it in the future.
  - daurnimator 11y ago
    They only let you do that on the $200 a month business plan
- nothrabannosir 11y ago
  There is still an advantage here, though: You can use a different hostname on the origin server. Use this to serve e.g. an S3 site on your own domain using SSL: S3 -> CloudFlare (with CloudFront) uses Amazon's certificates for their hostnames. Cloudflare -> internet uses your website's hostname and certificates. Total money spent on SSL: $0.
- bradyd 11y ago
  CloudFlare has a free CA for signing certificates specifically for this situation. It was beta in February. Not sure if it is generally available yet. https://blog.cloudflare.com/universal-ssl-encryption-all-the-way-to-the-origin-for-free/ https://blog.cloudflare.com/universal-ssl-encryption-all-the...

incarnate 11y ago

Ah, but to use the Full SSL options you need an SSL on your origin server (which CloudFlare doesn't provide for free)!

BillinghamJ 11y ago
That certificate can be self signed.
- mehrdada 11y ago
  In which case, it can be easily MITM'd by an attacker sitting between CloudFlare and your server, which makes it only slightly better than plain HTTP. It would have been great if CloudFlare let the user to upload and pin a specific self-signed certificate that it could then validate to prevent such attacks.
- gurrone 11y ago
  I think there was some rumors that they are - or are planing - to offer certificates signed by a private Cloudflare CA exactly for the purpose of encrypting the traffic to the backend.

johncolanduoni 11y ago

Unfortunately, this means you either have to use a self-signed cert which CloudFlare will not verify at all (meaning it can be MITMed) or use one signed by a trusted CA... which brings you back to square one.

leni536 11y ago
> self-signed cert which CloudFlare will not verify at all. Why would they do that? I never used this feature of CloudFlare, but it would be only logical to require you to upload the cert so they can verify against it in the future.
- daurnimator 11y ago
  They only let you do that on the $200 a month business plan
nothrabannosir 11y ago
There is still an advantage here, though: You can use a different hostname on the origin server. Use this to serve e.g. an S3 site on your own domain using SSL: S3 -> CloudFlare (with CloudFront) uses Amazon's certificates for their hostnames. Cloudflare -> internet uses your website's hostname and certificates. Total money spent on SSL: $0.
bradyd 11y ago
CloudFlare has a free CA for signing certificates specifically for this situation. It was beta in February. Not sure if it is generally available yet. https://blog.cloudflare.com/universal-ssl-encryption-all-the-way-to-the-origin-for-free/ https://blog.cloudflare.com/universal-ssl-encryption-all-the...