4 ms·

I think you could probably just point your DNS at Cloudflare to proxy your site through them; their service includes SSL plus some extras like caching and such

I think you could probably just point your DNS at Cloudflare to proxy your site through them; their service includes SSL plus some extras like caching and such for free. I've used them for a handful of projects and it's worked great.

simcop2387 10y ago
That said it will still be insecure because of the unencrypted path from cloudflare to you server but it will hire the error
- andybak 10y ago
  For some definitions of "insecure".
  - andybak 10y ago
    Hmmmm. -4. I fleshed out my thoughts in slightly more detail in another comment: https://news.ycombinator.com/item?id=13458224 https://news.ycombinator.com/item?id=13458224
- Latty 10y ago
  Cloudflare will provide you with certificates they generate, that they verify but won't be accepted by anyone else. (No cost because of that) - this keeps the data secure between you are them. Obviously, you are still trusitng cloudflare in the middle, but still less trust required.
  - icebraining 10y ago
    If you can install a certificate, you can already get a real one from Lets Encrypt (you don't actually need to run their client on the server). The problem is that many shared hosting services are still stuck in the past, and don't let you use SSL/TLS at all.
    - Latty 10y ago
      Without running the client, that means manually changing the cert for expiry, which is very short on LetsEncrypt certs. That introudces the possibility of forgetting or messing it up. I agree that the best option is for shared hosts just to build in support for LetsEncrypt.
      - deleted 10y ago
        [deleted]
- Vinnl 10y ago
  Hmm, so let's say I'm hosting my static files on S3. I've currently got CloudFlare setup in front of it but that apparently doesn't help. Anything I can do other than not using S3?
  - axman6 10y ago
    Use CloudFront? Took me about an hour to set up for my S3 based blog, free TLS, http/2 and IPv6 without any setup apart from a checkbox.
    - Vinnl 10y ago
      Right, so I've currently got CloudFront in front of it, but doesn't that move the problem? Now the connection between CloudFront and S3 is unencrypted. (I'm probably understanding this wrong, but I'd like to understand why.)

simcop2387 10y ago

That said it will still be insecure because of the unencrypted path from cloudflare to you server but it will hire the error

andybak 10y ago
For some definitions of "insecure".
- andybak 10y ago
  Hmmmm. -4. I fleshed out my thoughts in slightly more detail in another comment: https://news.ycombinator.com/item?id=13458224 https://news.ycombinator.com/item?id=13458224
Latty 10y ago
Cloudflare will provide you with certificates they generate, that they verify but won't be accepted by anyone else. (No cost because of that) - this keeps the data secure between you are them. Obviously, you are still trusitng cloudflare in the middle, but still less trust required.
- icebraining 10y ago
  If you can install a certificate, you can already get a real one from Lets Encrypt (you don't actually need to run their client on the server). The problem is that many shared hosting services are still stuck in the past, and don't let you use SSL/TLS at all.
  - Latty 10y ago
    Without running the client, that means manually changing the cert for expiry, which is very short on LetsEncrypt certs. That introudces the possibility of forgetting or messing it up. I agree that the best option is for shared hosts just to build in support for LetsEncrypt.
    - deleted 10y ago
      [deleted]
Vinnl 10y ago
Hmm, so let's say I'm hosting my static files on S3. I've currently got CloudFlare setup in front of it but that apparently doesn't help. Anything I can do other than not using S3?
- axman6 10y ago
  Use CloudFront? Took me about an hour to set up for my S3 based blog, free TLS, http/2 and IPv6 without any setup apart from a checkbox.
  - Vinnl 10y ago
    Right, so I've currently got CloudFront in front of it, but doesn't that move the problem? Now the connection between CloudFront and S3 is unencrypted. (I'm probably understanding this wrong, but I'd like to understand why.)