3 ms·

Right, with Stackpath they do TLS but not necessarily on the primary domain. You don't have to point your nameservers if you don't want to. So you can set them

Right, with Stackpath they do TLS but not necessarily on the primary domain. You don't have to point your nameservers if you don't want to. So you can set them up on a subdomain and use their fake SSL to serve purely static files (if the file doesn't exist on CDN at the time it's requested then their system will pull it directly from your server via a private subdomain, serve it to the client and store it for next time) So in this way it's possible to setup CDN with shared SSL for purely static files but not the app server itself; you don't have to give the keys to the whole kingdom so to speak and it's cheaper than Cloudflare at the basic level.

Kalium 6y ago
Let me see if I follow. Auto-provisioned TLS (misleadingly termed "fake SSL") on the front-end for delivering static contents and caching. A private subdomain with a pinned cert not managed by the CDN to deliver static contents to the CDN. And a third subdomain for the application itself that's not going through the CDN. I was under the impression that the same result could be achieved with Cloudflare, or indeed nearly any CDN. Was I mistaken? Though you may not actually need a secret, private subdomain for static files with all CDNs. Again, please let me know if I've made a mistake somewhere. I'd love to learn something this morning.
- henriquez 6y ago
  You're right about that. So it might look like this static.domain.com (CDN subdomain with auto provisioned TLS) static-uncached.domain.com (private pass-through subdomain when CDN is missing a file) www.domain.com (app server hosted wherever) You're right that you could do something similar with other CDNs including Cloudflare (you can just set the www subdomain to "bypass Cloudflare" to accomplish a similar result), but I'm not aware of any way to use Cloudflare on a domain without forwarding your nameservers to them, effectively giving them complete control over the domain. At least with Stackpath I can host DNS wherever and simply point the subdomains I want at them. Also, by the time you do the work to split static files into separate subdomains you might as well go with a dedicated CDN. One of the selling points of Cloudflare is for sites serving everything on one subdomain that they can forward to Cloudflare and get caching without any work.
  - edaemon 6y ago
    They have a CNAME setup where authoritative DNS stays outside of Cloudflare: https://support.cloudflare.com/hc/en-us/articles/360020615111-Configuring-a-CNAME-setup https://support.cloudflare.com/hc/en-us/articles/36002061511... It requires at least the Business level plan, though.
    - henriquez 6y ago
      Ah my bad. That’s probably why I never knew about it. The $200/month entry price is steep there.

Kalium 6y ago

Let me see if I follow. Auto-provisioned TLS (misleadingly termed "fake SSL") on the front-end for delivering static contents and caching. A private subdomain with a pinned cert not managed by the CDN to deliver static contents to the CDN. And a third subdomain for the application itself that's not going through the CDN. I was under the impression that the same result could be achieved with Cloudflare, or indeed nearly any CDN. Was I mistaken? Though you may not actually need a secret, private subdomain for static files with all CDNs. Again, please let me know if I've made a mistake somewhere. I'd love to learn something this morning.

henriquez 6y ago
You're right about that. So it might look like this static.domain.com (CDN subdomain with auto provisioned TLS) static-uncached.domain.com (private pass-through subdomain when CDN is missing a file) www.domain.com (app server hosted wherever) You're right that you could do something similar with other CDNs including Cloudflare (you can just set the www subdomain to "bypass Cloudflare" to accomplish a similar result), but I'm not aware of any way to use Cloudflare on a domain without forwarding your nameservers to them, effectively giving them complete control over the domain. At least with Stackpath I can host DNS wherever and simply point the subdomains I want at them. Also, by the time you do the work to split static files into separate subdomains you might as well go with a dedicated CDN. One of the selling points of Cloudflare is for sites serving everything on one subdomain that they can forward to Cloudflare and get caching without any work.
- edaemon 6y ago
  They have a CNAME setup where authoritative DNS stays outside of Cloudflare: https://support.cloudflare.com/hc/en-us/articles/360020615111-Configuring-a-CNAME-setup https://support.cloudflare.com/hc/en-us/articles/36002061511... It requires at least the Business level plan, though.
  - henriquez 6y ago
    Ah my bad. That’s probably why I never knew about it. The $200/month entry price is steep there.