6 ms·
We use several CAs to issue—Comodo, DigiCert, GlobalSign—and will be adding Let's Encrypt once they support i) SHA-2/ECDSA signatures and ii) wildcards. Having
by prdonahue 9y ago
We use several CAs to issue—Comodo, DigiCert, GlobalSign—and will be adding Let's Encrypt once they support i) SHA-2/ECDSA signatures and ii) wildcards.
Having multiple issuers is important for us as each CA, at some point in time, has operational issues. Additionally, as you've seen with Symantec, browsers take action to distrust certain issuers/roots.
When either of these scenarios happens, our customers don't care if it's the third-party that's down—they expect fast and reliable issuance from us (Cloudflare).
- originalsimba 9y agoIf Cloudflare wants wildcards it's so they can have multiple customers, each using completely different origin servers, on a single certificate, which makes those certificates worthless, and I hope Let's Encrypt blacklists Cloudflare from using them when wildcards are launched.
- niij 9y agoHow is that misusing a wildcard certificate? Should proxy server websites be HTTP only since the content is loaded from a different origin server?
- originalsimba 9y agoWhy does a proxy server need to decrypt traffic to serve it? Why can't it simply _act as a proxy_? What Cloudflare does is dangerous to the integrity of safe browsing, for a variety of reasons. And their aggressive marketing to convince a lot of tech-ignorant people with low traffic websites that they need a CDN is harmful. Is it too much to ask that their service at least operate in a way that doesn't poison the internet they're getting rich from?
- duskwuff 9y agoWhat you're describing is a multi-domain certificate, not a wildcard. Let's Encrypt already supports multi-domain certificates.
- jgrahamc 9y agoHuh? We want wildcards so that if you sign up example.com we can give you a certificate for example.com and *.example.com. This has nothing to do with SANs.
- originalsimba 9y agoHowever, that is apparently a deal breaker, which makes me suspicious because many organizations have no trouble implementing Let's Encrypt SSL despite the lack of wildcard support. That + Past Behavior = suspicion.
- jgrahamc 9y agoWhich part is a deal breaker? I'm not sure what you are getting at.
- originalsimba 9y agoI am quoting an earlier comment in this very thread: "We use several CAs to issue—Comodo, DigiCert, GlobalSign—and will be adding Let's Encrypt once they support i) SHA-2/ECDSA signatures and ii) wildcards." Did your colleague mis-speak?
- jgrahamc 9y agoNo
- waterbomb 9y agoThey are not worthless. They still protect the data from the user to the Cloudflare servers, and only Cloudflare keeps the private keys for them. Not sure how this would be made any safer by each domain having a separate certificate. The main issue is that Cloudflare needs to have plain-text traffic to examine, which cannot be done with End-to-End encryption from the client to the origin server, in which case you would definitely need a separate certificate for each domain.