3 ms·

Unfortunately, this means you either have to use a self-signed cert which CloudFlare will not verify at all (meaning it can be MITMed) or use one signed by a tr

Unfortunately, this means you either have to use a self-signed cert which CloudFlare will not verify at all (meaning it can be MITMed) or use one signed by a trusted CA... which brings you back to square one.

leni536 11y ago
> self-signed cert which CloudFlare will not verify at all. Why would they do that? I never used this feature of CloudFlare, but it would be only logical to require you to upload the cert so they can verify against it in the future.
- daurnimator 11y ago
  They only let you do that on the $200 a month business plan
nothrabannosir 11y ago
There is still an advantage here, though: You can use a different hostname on the origin server. Use this to serve e.g. an S3 site on your own domain using SSL: S3 -> CloudFlare (with CloudFront) uses Amazon's certificates for their hostnames. Cloudflare -> internet uses your website's hostname and certificates. Total money spent on SSL: $0.
bradyd 11y ago
CloudFlare has a free CA for signing certificates specifically for this situation. It was beta in February. Not sure if it is generally available yet. https://blog.cloudflare.com/universal-ssl-encryption-all-the-way-to-the-origin-for-free/ https://blog.cloudflare.com/universal-ssl-encryption-all-the...