5 ms·

It already is free. Just use CloudFlare.

nailer 11y ago
The article already mentions existing free providers like StartSSL and Let's Encrypt - if you really like I can add CF in there too John ;^) - but that's not news.
- tombrossman 11y ago
  Perfect illustration of 'free as in speech or free as in beer?'. Wonder who I should contact at CloudFlare for my 'free' DV cert that I can use on my server...
mikeash 11y ago
Does CloudFlare provide free certs for anyone, or do you have to actually use their CDN?
- prothid 11y ago
  I just used this feature with them the other day. The way it works is that if you enable SSL on a site passing through them, they'll auto-generate the front-end cert. I believe you can add your own cert for a premium. The back-end cert can be set to validated/unvalidated/unencrypted.
  - mikeash 11y ago
    If you have to use their CDN to get the free cert, then it's completely wrong to bring it up as "already is free" in this context.
    - takeda 11y ago
      It seems like you need to use their CDN to get it, so that sounds to me a bit like those "free" gifts you receive with a purchase. Not truly free.
      - Navarr 11y ago
        Free gift for a free services.. seems free?
        mikeash 11y ago
        It's free, but not the same as what's described in the article. The article is talking about free certs you can use with your own servers.
      - middleclick 11y ago
        True, I don't understand how setting up CloudFlare and getting a cert are the same. They are not.
      - deleted 11y ago
        [deleted]
- thetmkay 11y ago
  From their page on SSL [0], it's only for CloudFlare customers. Also, it's not end-to-end encryption, but from client to CloudFlare - so "your" certificate may have 20+ other CloudFlare clients' domains included. If you are using CloudFlare it makes it easy to set up, and +1 to them for making it available on all their plans. However, they're not a CA (they use Comodo?) nor a place to get free DV SSL certs (on its own). On a personal note, I'm not surprised at all by this news. I received and installed a LetsEncrypt DV over the weekend on my Ubuntu/nginx/node DigitalOcean Droplet. So easy - no way a CA can justify selling DVs anymore. [0]https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/
  - mikeash 11y ago
    Yeah, CloudFlare definitely deserves some praise for supporting SSL on all of their plans. It's just not a case of a free SSL cert for general use. And indeed, no surprise. Competition causes companies to compete! Shocking. But good to see just the same. How was your experience with LetsEncrypt?
    - thetmkay 11y ago
      Really smooth - my only two concerns are: 1. not implemented the auto client yet for nginx (which meant stopping the service) 2. the opaque-ness of when my domains would be whitelisted Both of which will be fixed for public beta/release (I believe).
      - pfg 11y ago
        Highly recommend webroot mode with something similar to this[1]. Put that into a cronjob together with service nginx reload and automated zero-downtime renewal is up and running. [1]: https://community.letsencrypt.org/t/using-the-webroot-domain-verification-method/1445/7?u=pfg https://community.letsencrypt.org/t/using-the-webroot-domain...
        thetmkay 11y ago
        Thanks - I'll check this out.
dspillett 11y ago
Which is in part what they are competing with to drive the need for them to take this direction. This will make it free without using cloudflare (which isn't desirable/suitable or all circumstances). It is free via StartSSL too, though some people have issues with that option.
k33l0r 11y ago
I tried using CloudFlare for my site, but they (or their CA partner) wouldn't issue a certificate for my domain (piranhas.co) because it contains the substring “iran”. Seriously[0]. [0]: https://twitter.com/matiaskorhonen/status/561063104596172800 https://twitter.com/matiaskorhonen/status/561063104596172800
- r1ch 11y ago
  I had the a similar problem, they refused to issue a certificate because the domain had a trademarked word in it. Seems strange they would be the ones to enforce trademarks, but I guess it could be considered as an anti-phishing measure or something.
  - prdonahue 11y ago
    This is a relic of the CA/B Forum (https://cabforum.org/ https://cabforum.org/) delegating review of brand/trademark checks to the CAs. We (CloudFlare) send hostnames to the CA for issuance and they check against internal lists, holding up anything for manual review that may violate another's trademark or be used for phishing (e.g., "pavpal" with a 'v' rather than a 'y'), etc. Each CA has their procedures but most look at data sources like the Alexa Top 1000, and specific requests from high value targets like Microsoft, Google, etc. In some cases, e.g., Microsoft, the CAs must actually reach out to specific contacts at those firms before they can issue. In other cases, they manually review and release to us.
- derekp7 11y ago
  So 20 years later we are still stuck with this: https://en.wikipedia.org/wiki/Scunthorpe_problem https://en.wikipedia.org/wiki/Scunthorpe_problem ?
  - mikeash 11y ago
    It's always going to be around in some form, it's a clbuttic problem.
  - Already__Taken 11y ago
michaelbuckbee 11y ago
Two caveats with Cloudflare, not really criticisms, more just that this is the deal: First, it's a shared certificate (several hundred other domains will share the cert with you). This has occasionally led to some awkwardness and misunderstanding in the non-tech world [1] and a few times has led to a site being blocked as "porn/inappropriate" by content filters as it gets identified with other sites. Second, in many cases it's not full browser to server encryption. Browser --(SSL)--> Cloudflare --(Not SSL)--> Server 1 - http://arstechnica.com/information-technology/2015/03/ted-cruz-for-presidents-ssl-certificate-nigerian-prince-headache/ http://arstechnica.com/information-technology/2015/03/ted-cr...
- prdonahue 11y ago
  "Several hundred other domains" is factually inaccurate. At most, there are ~40 other zones on the certificate (typically, far fewer). The challenge here is IPv4 address space; we don't require SNI for paid plans -- cert will be returned even if server_name is omitted from the TLS ClientHello -- so we must assign these customers dedicated IP pools. We're actually in the progress of migrating all paid customers to their own certificates, so this issue will go away soon.
obituary_latte 11y ago
This shouldn't be flagged. It is a viable solution. The mechanics of which can be debated, but you do get a valid cert.

The article already mentions existing free providers like StartSSL and Let's Encrypt - if you really like I can add CF in there too John ;^) - but that's not news.

tombrossman 11y ago
Perfect illustration of 'free as in speech or free as in beer?'. Wonder who I should contact at CloudFlare for my 'free' DV cert that I can use on my server...

mikeash 11y ago

Does CloudFlare provide free certs for anyone, or do you have to actually use their CDN?

prothid 11y ago
I just used this feature with them the other day. The way it works is that if you enable SSL on a site passing through them, they'll auto-generate the front-end cert. I believe you can add your own cert for a premium. The back-end cert can be set to validated/unvalidated/unencrypted.
- mikeash 11y ago
  If you have to use their CDN to get the free cert, then it's completely wrong to bring it up as "already is free" in this context.
  - takeda 11y ago
    It seems like you need to use their CDN to get it, so that sounds to me a bit like those "free" gifts you receive with a purchase. Not truly free.
    - Navarr 11y ago
      Free gift for a free services.. seems free?
      - mikeash 11y ago
        It's free, but not the same as what's described in the article. The article is talking about free certs you can use with your own servers.
    - middleclick 11y ago
      True, I don't understand how setting up CloudFlare and getting a cert are the same. They are not.
    - deleted 11y ago
      [deleted]
thetmkay 11y ago
From their page on SSL [0], it's only for CloudFlare customers. Also, it's not end-to-end encryption, but from client to CloudFlare - so "your" certificate may have 20+ other CloudFlare clients' domains included. If you are using CloudFlare it makes it easy to set up, and +1 to them for making it available on all their plans. However, they're not a CA (they use Comodo?) nor a place to get free DV SSL certs (on its own). On a personal note, I'm not surprised at all by this news. I received and installed a LetsEncrypt DV over the weekend on my Ubuntu/nginx/node DigitalOcean Droplet. So easy - no way a CA can justify selling DVs anymore. [0]https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/
- mikeash 11y ago
  Yeah, CloudFlare definitely deserves some praise for supporting SSL on all of their plans. It's just not a case of a free SSL cert for general use. And indeed, no surprise. Competition causes companies to compete! Shocking. But good to see just the same. How was your experience with LetsEncrypt?
  - thetmkay 11y ago
    Really smooth - my only two concerns are: 1. not implemented the auto client yet for nginx (which meant stopping the service) 2. the opaque-ness of when my domains would be whitelisted Both of which will be fixed for public beta/release (I believe).
    - pfg 11y ago
      Highly recommend webroot mode with something similar to this[1]. Put that into a cronjob together with service nginx reload and automated zero-downtime renewal is up and running. [1]: https://community.letsencrypt.org/t/using-the-webroot-domain-verification-method/1445/7?u=pfg https://community.letsencrypt.org/t/using-the-webroot-domain...
      - thetmkay 11y ago
        Thanks - I'll check this out.

dspillett 11y ago

Which is in part what they are competing with to drive the need for them to take this direction. This will make it free without using cloudflare (which isn't desirable/suitable or all circumstances). It is free via StartSSL too, though some people have issues with that option.

k33l0r 11y ago

I tried using CloudFlare for my site, but they (or their CA partner) wouldn't issue a certificate for my domain (piranhas.co) because it contains the substring “iran”. Seriously[0]. [0]: https://twitter.com/matiaskorhonen/status/561063104596172800 https://twitter.com/matiaskorhonen/status/561063104596172800

r1ch 11y ago
I had the a similar problem, they refused to issue a certificate because the domain had a trademarked word in it. Seems strange they would be the ones to enforce trademarks, but I guess it could be considered as an anti-phishing measure or something.
- prdonahue 11y ago
  This is a relic of the CA/B Forum (https://cabforum.org/ https://cabforum.org/) delegating review of brand/trademark checks to the CAs. We (CloudFlare) send hostnames to the CA for issuance and they check against internal lists, holding up anything for manual review that may violate another's trademark or be used for phishing (e.g., "pavpal" with a 'v' rather than a 'y'), etc. Each CA has their procedures but most look at data sources like the Alexa Top 1000, and specific requests from high value targets like Microsoft, Google, etc. In some cases, e.g., Microsoft, the CAs must actually reach out to specific contacts at those firms before they can issue. In other cases, they manually review and release to us.
derekp7 11y ago
So 20 years later we are still stuck with this: https://en.wikipedia.org/wiki/Scunthorpe_problem https://en.wikipedia.org/wiki/Scunthorpe_problem ?
- mikeash 11y ago
  It's always going to be around in some form, it's a clbuttic problem.
- Already__Taken 11y ago

michaelbuckbee 11y ago

Two caveats with Cloudflare, not really criticisms, more just that this is the deal: First, it's a shared certificate (several hundred other domains will share the cert with you). This has occasionally led to some awkwardness and misunderstanding in the non-tech world [1] and a few times has led to a site being blocked as "porn/inappropriate" by content filters as it gets identified with other sites. Second, in many cases it's not full browser to server encryption. Browser --(SSL)--> Cloudflare --(Not SSL)--> Server 1 - http://arstechnica.com/information-technology/2015/03/ted-cruz-for-presidents-ssl-certificate-nigerian-prince-headache/ http://arstechnica.com/information-technology/2015/03/ted-cr...

prdonahue 11y ago
"Several hundred other domains" is factually inaccurate. At most, there are ~40 other zones on the certificate (typically, far fewer). The challenge here is IPv4 address space; we don't require SNI for paid plans -- cert will be returned even if server_name is omitted from the TLS ClientHello -- so we must assign these customers dedicated IP pools. We're actually in the progress of migrating all paid customers to their own certificates, so this issue will go away soon.

obituary_latte 11y ago

This shouldn't be flagged. It is a viable solution. The mechanics of which can be debated, but you do get a valid cert.