5 ms·

From their page on SSL [0], it's only for CloudFlare customers. Also, it's not end-to-end encryption, but from client to CloudFlare - so "your" certificate may

From their page on SSL [0], it's only for CloudFlare customers. Also, it's not end-to-end encryption, but from client to CloudFlare - so "your" certificate may have 20+ other CloudFlare clients' domains included. If you are using CloudFlare it makes it easy to set up, and +1 to them for making it available on all their plans. However, they're not a CA (they use Comodo?) nor a place to get free DV SSL certs (on its own). On a personal note, I'm not surprised at all by this news. I received and installed a LetsEncrypt DV over the weekend on my Ubuntu/nginx/node DigitalOcean Droplet. So easy - no way a CA can justify selling DVs anymore. [0]https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/

mikeash 11y ago
Yeah, CloudFlare definitely deserves some praise for supporting SSL on all of their plans. It's just not a case of a free SSL cert for general use. And indeed, no surprise. Competition causes companies to compete! Shocking. But good to see just the same. How was your experience with LetsEncrypt?
- thetmkay 11y ago
  Really smooth - my only two concerns are: 1. not implemented the auto client yet for nginx (which meant stopping the service) 2. the opaque-ness of when my domains would be whitelisted Both of which will be fixed for public beta/release (I believe).
  - pfg 11y ago
    Highly recommend webroot mode with something similar to this[1]. Put that into a cronjob together with service nginx reload and automated zero-downtime renewal is up and running. [1]: https://community.letsencrypt.org/t/using-the-webroot-domain-verification-method/1445/7?u=pfg https://community.letsencrypt.org/t/using-the-webroot-domain...
    - thetmkay 11y ago
      Thanks - I'll check this out.
  - mikeash 11y ago
    Good to hear. I'm hoping to start using them once they go public. Regarding #2, do I understand correctly that domain whitelisting is just about which domains can be used with the current closed beta?
    - thetmkay 11y ago
      I presume so. There may be some regulation (or suggested guidelines) about high-trust sites (like banks) that are vulnerable to phishing requiring EVs. Otherwise using the Google Safe Browsing API (as they plan on doing[1]) will probably work and is automated. [0]https://letsencrypt.org/2015/10/29/phishing-and-malware.html https://letsencrypt.org/2015/10/29/phishing-and-malware.html
  - Globz 11y ago
    I can't wait to test it out when the Public beta will start. I am currently in the process of deploying a new webserver at work so I will certainly give this a go.
vtlynch 11y ago
>so "your" certificate may have 20+ other CloudFlare clients' domains included Just to clarify here, "your" certificate will definitely have around 90 or so other domains listed in it as SANs.

mikeash 11y ago

Yeah, CloudFlare definitely deserves some praise for supporting SSL on all of their plans. It's just not a case of a free SSL cert for general use. And indeed, no surprise. Competition causes companies to compete! Shocking. But good to see just the same. How was your experience with LetsEncrypt?

thetmkay 11y ago
Really smooth - my only two concerns are: 1. not implemented the auto client yet for nginx (which meant stopping the service) 2. the opaque-ness of when my domains would be whitelisted Both of which will be fixed for public beta/release (I believe).
- pfg 11y ago
  Highly recommend webroot mode with something similar to this[1]. Put that into a cronjob together with service nginx reload and automated zero-downtime renewal is up and running. [1]: https://community.letsencrypt.org/t/using-the-webroot-domain-verification-method/1445/7?u=pfg https://community.letsencrypt.org/t/using-the-webroot-domain...
  - thetmkay 11y ago
    Thanks - I'll check this out.
- mikeash 11y ago
  Good to hear. I'm hoping to start using them once they go public. Regarding #2, do I understand correctly that domain whitelisting is just about which domains can be used with the current closed beta?
  - thetmkay 11y ago
    I presume so. There may be some regulation (or suggested guidelines) about high-trust sites (like banks) that are vulnerable to phishing requiring EVs. Otherwise using the Google Safe Browsing API (as they plan on doing[1]) will probably work and is automated. [0]https://letsencrypt.org/2015/10/29/phishing-and-malware.html https://letsencrypt.org/2015/10/29/phishing-and-malware.html
- Globz 11y ago
  I can't wait to test it out when the Public beta will start. I am currently in the process of deploying a new webserver at work so I will certainly give this a go.

vtlynch 11y ago

>so "your" certificate may have 20+ other CloudFlare clients' domains included Just to clarify here, "your" certificate will definitely have around 90 or so other domains listed in it as SANs.