4 ms·
The easiest way to manage I've found so far - put it behind Cloudflare. Caching, certs management, www. redirect handling (with SSL support), basic protection -
by shcheklein 5y ago
The easiest way to manage I've found so far - put it behind Cloudflare. Caching, certs management, www. redirect handling (with SSL support), basic protection - all comes for free. You would need to install their own cert on your infra, but it has 10 or 15 year to expire.
- sen 5y agoThen you're shunning anyone who uses a VPN, anyone who uses privacy plugins, etc etc. I despise Cloudflare these days because I'm pretty much required to use a VPN to access the web and get around geolocked content everywhere, and then Cloudflare blocks me from browsing even basic static sites.
- shcheklein 5y agoInteresting, I've never tried this. I'll check it out.
- selcuka 5y agoCloudFlare, being a reverse proxy, has many limitations (such as forced cookies and the upload limit) but I agree that it is ok for many use cases. Let's Encrypt is easily automated and doesn't have any of those downsides.
- EE84M3i 5y agoAre there still "forced cookies" after this change? https://blog.cloudflare.com/deprecating-cfduid-cookie/ https://blog.cloudflare.com/deprecating-cfduid-cookie/
- notatoad 5y ago>it has 10 or 15 years to expire Dont browsers reject certs with longer than one year validity?
- StopHammoTime 5y agoThey’re talking about the cert between edge and origin (I.e. cloudflare and your server). The client never sees that cert because they don’t talk directly to your origin.
- aaomidi 5y agoThis is the internal traffic between CF and you. So it's never exposed to browsers.
- darylteo 5y agoNot an option for Australia clients on the free tier - it gets routed through Hong Kong! :( In any case, Cloudfront has been a cheap value option with a easy DNS based certificate renewal process.