3 ms·

My follow up questions on this is. I run my website from S3 behind CloudFlare. How can I achieve free SSL without involving my own servers to terminate SSL and

by K0nserv 10y ago

My follow up questions on this is. I run my website from S3 behind CloudFlare. How can I achieve free SSL without involving my own servers to terminate SSL and having to maintain and rotate certificates say using Let's Encrypt?

joepie91_ 10y ago
> I run my website from S3 behind CloudFlare. How can I achieve free SSL without involving my own servers to terminate SSL You can't, at least not without using a different service that works exactly like CloudFlare (which would obviously defeat the point). You probably shouldn't be hosting your site on S3 to begin with (this isn't what it's for, really), and you wouldn't have this problem in the first place. > and having to maintain and rotate certificates say using Let's Encrypt? Use Caddy, which does this all automatically without you even having to think about it.
- bckygldstn 10y ago
  It's not just S3 though. Lots of not-quite fully-featured services like App Engine, GitHub pages, and Heroku benefit from Cloudflare's SSL and other configuration options. For many use cases security is a tradeoff, and trusting one more US-based company can be worthwhile for both users and site owners.
  - bad_user 10y ago
    Setting up your own Ubuntu instance on DigitalOcean (or similar) along with Nginx and Let's Encrypt certificates is cheap and easy to do. I can't figure out why people use GitHub Pages for hosting static pages for their projects, without end-to-end encryption. It's actually quite a problem, given libraries are a primary target for malware. And if you can work with Git, then you also can also do "apt install nginx". The best part about a VPS is that you can do more things with it, like having your own VPN, or XMPP server. And the web is full of step by step tutorials. And you may invoke the convenience of it, but that convenience comes with a broken security model.
    - K0nserv 10y ago
      See above about cost and labour required. If you stick with the github.io domain you still have free SSL termination.
- K0nserv 10y ago
  > You can't, at least not without using a different service that works exactly like CloudFlare (which would obviously defeat the point). You probably shouldn't be hosting your site on S3 to begin with (this isn't what it's for, really), and you wouldn't have this problem in the first place. I understand your point about CloudFlare as an intermediary for SSL not being ideal and I agree. On the S3 issue I quite strongly disagree, if you have a site that updates infrequently and can be compiled as static files S3 is one of the absolute best choices because it's cheap and requires you to manage no infrastructure at all. It is indeed one of the things it is for, they wouldn't have a public website checkbox if that wasn't the case. > Use Caddy, which does this all automatically without you even having to think about it. Again this has the prerequisite of maintaining infrastructure which needs to be kept up to date and secure. It's also massively more expensive than S3 for my use case.
  - joepie91_ 10y ago
    > S3 is one of the absolute best choices because it's cheap and requires you to manage no infrastructure at all ... and there is no possibility of ever having proper TLS, with or without CloudFlare. That alone disqualifies it as "best". It simply doesn't meet minimum requirements. > Again this has the prerequisite of maintaining infrastructure which needs to be kept up to date and secure. It's also massively more expensive than S3 for my use case. What are you paying for S3, currently?
    - K0nserv 10y ago
      > ... and there is no possibility of ever having proper TLS, with or without CloudFlare. That alone disqualifies it as "best". It simply doesn't meet minimum requirements. I'd argue that using CloudFront for SSL termination would be slightly better, but ultimately even just running an EC2 instance implies trusting Amazon and giving them power to intercept and mess with your traffic. So I guess with CloudFlare the only difference is you are trusting one more entity that could screw you over. So you end up trusting both Amazon and CloudFlare. > What are you paying for S3, currently? I pay roughly $0.03/month so switching to something like a DO droplet($5/month) would increase cost by 16566%, increase labour required and make the site less stable and more vulnerable to hug of death scenarios.
EwanToo 10y ago
AWS do free SSL certificates via their certificate manager service now, it works via cloudfront their own CDN (as well as other services) which can use s3 as a back-end
- K0nserv 10y ago
  I've had pretty bad experiences with cloudfront but might be interesting. How does the free SSL work?

by K0nserv 10y ago

joepie91_ 10y ago

> I run my website from S3 behind CloudFlare. How can I achieve free SSL without involving my own servers to terminate SSL You can't, at least not without using a different service that works exactly like CloudFlare (which would obviously defeat the point). You probably shouldn't be hosting your site on S3 to begin with (this isn't what it's for, really), and you wouldn't have this problem in the first place. > and having to maintain and rotate certificates say using Let's Encrypt? Use Caddy, which does this all automatically without you even having to think about it.

bckygldstn 10y ago
It's not just S3 though. Lots of not-quite fully-featured services like App Engine, GitHub pages, and Heroku benefit from Cloudflare's SSL and other configuration options. For many use cases security is a tradeoff, and trusting one more US-based company can be worthwhile for both users and site owners.
- bad_user 10y ago
  Setting up your own Ubuntu instance on DigitalOcean (or similar) along with Nginx and Let's Encrypt certificates is cheap and easy to do. I can't figure out why people use GitHub Pages for hosting static pages for their projects, without end-to-end encryption. It's actually quite a problem, given libraries are a primary target for malware. And if you can work with Git, then you also can also do "apt install nginx". The best part about a VPS is that you can do more things with it, like having your own VPN, or XMPP server. And the web is full of step by step tutorials. And you may invoke the convenience of it, but that convenience comes with a broken security model.
  - K0nserv 10y ago
    See above about cost and labour required. If you stick with the github.io domain you still have free SSL termination.
K0nserv 10y ago
> You can't, at least not without using a different service that works exactly like CloudFlare (which would obviously defeat the point). You probably shouldn't be hosting your site on S3 to begin with (this isn't what it's for, really), and you wouldn't have this problem in the first place. I understand your point about CloudFlare as an intermediary for SSL not being ideal and I agree. On the S3 issue I quite strongly disagree, if you have a site that updates infrequently and can be compiled as static files S3 is one of the absolute best choices because it's cheap and requires you to manage no infrastructure at all. It is indeed one of the things it is for, they wouldn't have a public website checkbox if that wasn't the case. > Use Caddy, which does this all automatically without you even having to think about it. Again this has the prerequisite of maintaining infrastructure which needs to be kept up to date and secure. It's also massively more expensive than S3 for my use case.
- joepie91_ 10y ago
  > S3 is one of the absolute best choices because it's cheap and requires you to manage no infrastructure at all ... and there is no possibility of ever having proper TLS, with or without CloudFlare. That alone disqualifies it as "best". It simply doesn't meet minimum requirements. > Again this has the prerequisite of maintaining infrastructure which needs to be kept up to date and secure. It's also massively more expensive than S3 for my use case. What are you paying for S3, currently?
  - K0nserv 10y ago
    > ... and there is no possibility of ever having proper TLS, with or without CloudFlare. That alone disqualifies it as "best". It simply doesn't meet minimum requirements. I'd argue that using CloudFront for SSL termination would be slightly better, but ultimately even just running an EC2 instance implies trusting Amazon and giving them power to intercept and mess with your traffic. So I guess with CloudFlare the only difference is you are trusting one more entity that could screw you over. So you end up trusting both Amazon and CloudFlare. > What are you paying for S3, currently? I pay roughly $0.03/month so switching to something like a DO droplet($5/month) would increase cost by 16566%, increase labour required and make the site less stable and more vulnerable to hug of death scenarios.

EwanToo 10y ago

AWS do free SSL certificates via their certificate manager service now, it works via cloudfront their own CDN (as well as other services) which can use s3 as a back-end

K0nserv 10y ago
I've had pretty bad experiences with cloudfront but might be interesting. How does the free SSL work?