4 ms·
Two caveats with Cloudflare, not really criticisms, more just that this is the deal: First, it's a shared certificate (several hundred other domains will share
by michaelbuckbee 11y ago
Two caveats with Cloudflare, not really criticisms, more just that this is the deal:
First, it's a shared certificate (several hundred other domains will share the cert with you). This has occasionally led to some awkwardness and misunderstanding in the non-tech world [1] and a few times has led to a site being blocked as "porn/inappropriate" by content filters as it gets identified with other sites.
Second, in many cases it's not full browser to server encryption.
Browser --(SSL)--> Cloudflare --(Not SSL)--> Server
1 - http://arstechnica.com/information-technology/2015/03/ted-cruz-for-presidents-ssl-certificate-nigerian-prince-headache/ http://arstechnica.com/information-technology/2015/03/ted-cr...
- prdonahue 11y ago"Several hundred other domains" is factually inaccurate. At most, there are ~40 other zones on the certificate (typically, far fewer). The challenge here is IPv4 address space; we don't require SNI for paid plans -- cert will be returned even if server_name is omitted from the TLS ClientHello -- so we must assign these customers dedicated IP pools. We're actually in the progress of migrating all paid customers to their own certificates, so this issue will go away soon.