3 ms·

All this talk about what CF should do, I'm surprised they didn't mention the most obvious step to take: offering an SSL mode that lets you configure what host n

All this talk about what CF should do, I'm surprised they didn't mention the most obvious step to take: offering an SSL mode that lets you configure what host name to validate the origin as. This would work perfectly for anyone using GitHub pages, cloud front, hyperdev, etc etc etc, all of which have valid ssl Certs, just not for your origin but for theirs. Am I missing an obvious reason for this not being an option? It must have crossed their minds at some point..? (Edit: come to think of it, iirc cloud front does support wild card ssl for your own domain these days?)

lorenzhs 10y ago
This would solve Troy's issue with his own site, too - his hoster serves it with a * .ghost.io certificate. If he could configure CloudFlare to only accept certificates that match troyhunt.ghost.io, that would be a lot safer. I have the same use case with GitHub pages -- https://www.glowing-bear.org https://www.glowing-bear.org is Full SSL in Cloudflare, but I can't switch it to Full (strict) because the upstream certificate is for * .github.io
- prdonahue 10y ago
  In the future we plan to allow for more granular origin certificate validation. For example, if you are CNAME'ing www.example.com to example.anotherprovider.com, you /may/ be fine with us checking that the origin certificate has a SAN matching that destination, *.anotherprovider.com, or a hostname that you specify.
  - lorenzhs 10y ago
    That's excellent to hear, thanks! I'm looking forward to that.