3 ms·

CloudFlare to Origin supports algorithms other the ECDSA. Sounds like you're having issues, not CloudFlare. CloudFlare only support ECDSA on the free plan from

by snug 10y ago

CloudFlare to Origin supports algorithms other the ECDSA. Sounds like you're having issues, not CloudFlare. CloudFlare only support ECDSA on the free plan from client to CloudFlare. If this is what you're having issues with, then you're on an old browser.

crabbytoday 10y ago
Thanks for trying to help, but I'm using FF 44.0.x and Chrome 52.0.27x. The disruption occurred when CF generated a new cert with ECDSA, the old cert worked fine, until it expired. https://support.cloudflare.com/hc/en-us/articles/200278659-Error-525-SSL-handshake-failed https://support.cloudflare.com/hc/en-us/articles/200278659-E... A 525 error states that the SSL handshake between CloudFlare and the origin server that hosts the domain failed. This means that CloudFlare is set to use Full SSL in the CloudFlare settings for the domain, so CloudFlare attempts to make a connection using SSL (for requests beginning in https:// https://) to server that hosts the domain. Likely reasons for this failure include: The origin server does not support or is not configured properly for SNI. The cipher suites that CloudFlare accepts and the cipher suites that the origin server uses do not match. The origin server is not configured to use SSL and Full SSL is enabled in the CloudFlare settings. "The cipher suites that CloudFlare accepts and the cipher suites that the origin server uses do not match." <- This. This is the issue. Again, I verified with the host and they do not plan on supporting ECDSA_P256 specifically, but do support other Elliptical Curve algos. So yes, it is an issue on my end but only to a point, the fallback certs that CF generates and manages aren't 'falling back'. There is no option to manage fallback certs on Free plan, that's fine, but the CF-provided fallbacks should have worked! Again, the issue is they generated a cert with a specific algo and presented that cert to my users without checking first to see if the server supported that algo. Make a cert signed with a random algo and who cares if it works or not? WTH? Again, I am not asking for tech support here. I am researching CloudFlare alternatives though to begin the process of setting up new accounts to prepare for moving from CloudFlare before those domains suffer the same fail when their CF certs expire. CF was great until it wasn't.
- deleted 10y ago
  [deleted]

by snug 10y ago

crabbytoday 10y ago

Thanks for trying to help, but I'm using FF 44.0.x and Chrome 52.0.27x. The disruption occurred when CF generated a new cert with ECDSA, the old cert worked fine, until it expired. https://support.cloudflare.com/hc/en-us/articles/200278659-Error-525-SSL-handshake-failed https://support.cloudflare.com/hc/en-us/articles/200278659-E... A 525 error states that the SSL handshake between CloudFlare and the origin server that hosts the domain failed. This means that CloudFlare is set to use Full SSL in the CloudFlare settings for the domain, so CloudFlare attempts to make a connection using SSL (for requests beginning in https:// https://) to server that hosts the domain. Likely reasons for this failure include: The origin server does not support or is not configured properly for SNI. The cipher suites that CloudFlare accepts and the cipher suites that the origin server uses do not match. The origin server is not configured to use SSL and Full SSL is enabled in the CloudFlare settings. "The cipher suites that CloudFlare accepts and the cipher suites that the origin server uses do not match." <- This. This is the issue. Again, I verified with the host and they do not plan on supporting ECDSA_P256 specifically, but do support other Elliptical Curve algos. So yes, it is an issue on my end but only to a point, the fallback certs that CF generates and manages aren't 'falling back'. There is no option to manage fallback certs on Free plan, that's fine, but the CF-provided fallbacks should have worked! Again, the issue is they generated a cert with a specific algo and presented that cert to my users without checking first to see if the server supported that algo. Make a cert signed with a random algo and who cares if it works or not? WTH? Again, I am not asking for tech support here. I am researching CloudFlare alternatives though to begin the process of setting up new accounts to prepare for moving from CloudFlare before those domains suffer the same fail when their CF certs expire. CF was great until it wasn't.

deleted 10y ago
[deleted]