3 ms·
This would solve Troy's issue with his own site, too - his hoster serves it with a * .ghost.io certificate. If he could configure CloudFlare to only accept cert
by lorenzhs 10y ago
This would solve Troy's issue with his own site, too - his hoster serves it with a * .ghost.io certificate. If he could configure CloudFlare to only accept certificates that match troyhunt.ghost.io, that would be a lot safer.
I have the same use case with GitHub pages -- https://www.glowing-bear.org https://www.glowing-bear.org is Full SSL in Cloudflare, but I can't switch it to Full (strict) because the upstream certificate is for * .github.io
- prdonahue 10y agoIn the future we plan to allow for more granular origin certificate validation. For example, if you are CNAME'ing www.example.com to example.anotherprovider.com, you /may/ be fine with us checking that the origin certificate has a SAN matching that destination, *.anotherprovider.com, or a hostname that you specify.
- lorenzhs 10y agoThat's excellent to hear, thanks! I'm looking forward to that.