4 ms·
This is a more subtle point about how cloudflare's flexible ssl works. The linked post describes a situation where the end user sees the ssl padlock, but the tr
by bubblethink 9y ago
This is a more subtle point about how cloudflare's flexible ssl works. The linked post describes a situation where the end user sees the ssl padlock, but the traffic is still getting MITM'ed between cloudflare and origin because it is not over https.
- jgrahamc 9y agoThere's no reason to use Flexible SSL. Cloudflare will support any certificate on the origin server (e.g. Let's Encrypt if you don't want to pay someone), or will give you a free "Origin CA" certificate.
- bubblethink 9y agoYes, that's fine. The problem is offering flexible ssl in the first place. It is not the end user's job to verify if the traffic between cloudflare and origin is encrypted.
- aptwebapps 9y ago"There's no reason to use Flexible SSL." Then why do you offer it?
- jgrahamc 9y agoBecause there are instances where the customer cannot put an SSL certificate on their server. So, I probably should have said "almost no reason".