5 ms·
With Cloudflare's first easy to use free SSL and later Lets Encrypt, I think it there are no more excuses for not being secure.
by milankragujevic 9y ago
With Cloudflare's first easy to use free SSL and later Lets Encrypt, I think it there are no more excuses for not being secure.
- thesmallestcat 9y agoCloudflare's free SSL is not secure.
- catshirt 9y agois not? or was not? honest question. care to elaborate for a noob?
- lambda 9y agoCloudFlare's "Flexible SSL" (https://www.cloudflare.com/ssl/ https://www.cloudflare.com/ssl/) offers encryption/authentication from CloudFlare's server to the client, but none from the origin server to CloudFlare's. Which means that is a vector by which the content could be sniffed or modified in transit. It's a "better than nothing" option, as there are a slightly higher number of actively exploited attack vectors that apply to the client to CDN connection than the CDN to origin server, such as "free" wifi that injects ads, malicious ISP DNS, and the like. But it's not actually secure, as the origin server to CDN connection could be tampered with, and just because there are fewer active attacks that would be likely to affect that connection right now, doesn't mean that someone won't come along later and hijack such a connection. CloudFlare offers other TLS options that do include encryption and authentication between the origin server and CDN, but they do require that you set up a certificate on your server, so if all you're trying to do is enable TLS (and don't care about the CDN), just installing a cert on the origin server and using TLS is probably a simpler option that using CloudFlare.
- catshirt 9y agogreat noob elaboration. much appreciated. :)
- prdonahue 9y agoWe encourage users to use Strict mode which requests and validates a certificate from the origin. It's great that shared web hosting providers and others are starting to make it easy to acquire and install a certificate, but that hasn't always been the case. EDIT: We also provide an API that will provision a free certificate for your origin: https://blog.cloudflare.com/cloudflare-ca-encryption-origin/ https://blog.cloudflare.com/cloudflare-ca-encryption-origin/. The certificate is optimized for communication with our edge (essentially just as small a chain as possible, as we don't need the intermediate to walk to the root). Either that or use certbot from EFF/Let's Encrypt.
- deleted 9y ago[deleted]
- justboxing 9y ago> is not? or was not? Troy Hunt (OP) discusses this at length in this post => CloudFlare, SSL and unhealthy security absolutism https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-security-absolutism/ https://www.troyhunt.com/cloudflare-ssl-and-unhealthy-securi...
- milankragujevic 9y agoWell it kind of is if you setup a self-signed SSL cert on your server and use Full SSL (not strict).
- blfr 9y agoYou can setup a Let's Encrypt certificate on your server and use Full SSL (strict). It will also make switching away from Cloudflare in the future easier.
- jgrahamc 9y agoThat's right. Cloudflare doesn't try to lock people in with artificial constraints. Use Let's Encrypt for your origin. Very soon we hope to support Let's Encrypt completely for our main certs (once they have wildcard support).
- deleted 9y ago[deleted]
- LarryMade2 9y agoExtra cost of a static IP hosting (needed for domain registration) is a big factor, doubles the costs of my small website hosting.
- finnn 9y agoDomain registration? That certainly doesn't require a static IP... nor does any other part of deploying TLS.
- throwaway2048 9y agohttps://en.wikipedia.org/wiki/Server_Name_Indication https://en.wikipedia.org/wiki/Server_Name_Indication Any host that still requires a dedicated IP for https is woefully out of date.
- mjevans 9y agoIt's sadly not just the servers but also the clients... still you're right about that being a really long tail at this point. Edit: A quick search seems to indicate that the only typical consumer facing system that doesn't support SNI is IE on Windows XP. It's pretty safe to have a catch-all bucket that informs such users to use a modern, security patches including browser or to upgrade to a different OS.
- throwaway2048 9y agoAnything that cant do SNI isn't going to support TLS 1.1+ and wont be able to access a huge percentage of the web anyways. Eventually old clients have to be let go of, maintaining compatibility for them degrades everyone else's security.
- kvz 9y agoUnless you support both via e.g. https://jve.linuxwall.info/blog/index.php?post/2015/10/04/SHA1/SHA256-certificate-switching-with-HAProxy https://jve.linuxwall.info/blog/index.php?post/2015/10/04/SH...
- grecy 9y agoI'm running Varnish in front of wordpress and mediawiki.... sure I can make it all work with HTTPS, but it's going to be a PITA.
- chrsstrm 9y agoNot really. You put nginx in front of Varnish and terminate your TLS there. It's not that much more work. Hint: make sure you have an X-Forwarded-For entry in your nginx config. Your root location would look something like: location / { proxy_pass http://localhost:8082; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Port 443; proxy_set_header X-Forwarded-Proto $scheme; } Assuming your Varnish setup was serving on 8082.
- LunaSea 9y agoLet's Encrypt's short expiration times make them too cumbersome to use.
- SquareWheel 9y agoThe point is to automate. If you're manually renewing them every thee months, then you're very much doing it wrong and it should be cumbersome.
- LunaSea 9y agoBut most people don't want or know how to automate. HTTPS is supposed to be used on very site but not every site is setup by a developer. That's a basic flaw that will make it problematic to have these kinds of HTTPS-only policies.
- SquareWheel 9y agoHaving done both, it's far easier to set up one of Let's Encrypts automatic tools than it is to install a certificate manually. End users won't be configuring their own servers anyway. At best they'll get a cPanel (which using AutoSSL, can then support Let's Encrypt).
- extra88 9y agoIf one can't handle setting up Let's Encrypt, they should host their content on a platform where others take care of things like HTTPS for them.