3 ms·

I assume you mean only ` Full (strict)` is secure, and not even `Full`? I happened to be recently looking at putting cloudflare in front of an S3 bucket, and i

I assume you mean only ` Full (strict)` is secure, and not even `Full`? I happened to be recently looking at putting cloudflare in front of an S3 bucket, and it looked maybe easier/more feasible to do with `Full` instead of `Full (Strict)` -- because you can skip configuring the S3 bucket have an SSL cert for your actual front-facing domain (which can be cumbersome and/or more expensive to set up) and just let CloudFlare connect to it as `*.s3.aws.com` or whatever. As long as CloudFlare is actually requiring a trusted cert for *.s3.aws.com, are there security implications I'm missing for why this is a bad idea? (I guess AWS or someone with the keys to AWS certs could be spoofing you? Anything else?) Or in general even without reference to this use case, explain vulnerability examples/threat models for `Full` without `Strict`?

r1ch 5y ago
Full does not check certificates, so a MITM can supply any untrusted certificate and intercept your traffic. Only Full (Strict) does trusted cert checking.
- ewuhic 5y ago
  "Can" theoretically, or there's a valid attack vector which one may pull off immediately in the wild?
  - captn3m0 5y ago
    The current Airtel scenario is a good demonstration I’d say.
  - r1ch 5y ago
    Cloudflare terminates SSL at the point closest to the user, so any of the ISPs between Cloudflare's POP and the origin could MITM the traffic. Normally an untrusted MITM cert would throw up a TLS error, but since the Cloudflare <-> End User part is trusted, a MITM attack with anything but Full (Strict) is undetectable to an end user. There's plenty of examples of ISPs trying this in the wild: https://www.zdnet.com/article/kazakhstan-government-is-now-intercepting-all-https-traffic/ https://www.zdnet.com/article/kazakhstan-government-is-now-i... https://www.reddit.com/r/sysadmin/comments/4vy3op/my_isp_is_trying_to_intercept_some_of_my_https/ https://www.reddit.com/r/sysadmin/comments/4vy3op/my_isp_is_... https://superuser.com/questions/176651/isp-replaces-ssl-certificates-any-solution https://superuser.com/questions/176651/isp-replaces-ssl-cert...
- jrochkind1 5y ago
  Huh, I didn't realize Full didn't check certs at all. Why don't they have a mode that checks that the cert is valid for hostname that you have configured cloudflare to access (which *.s3.amazonaws.com already has), rather than for the end-point that the destination isn't actually answering on directly itself? Or maybe I'm misunderstanding what was up, have to mess with it more.
sirshmooey 5y ago
Just use a free Cloudflare Origin CA certificate and set to strict. Encryption for the whole round trip unless someone accesses origin server directly. https://developers.cloudflare.com/ssl/origin-configuration/origin-ca https://developers.cloudflare.com/ssl/origin-configuration/o...
- jrochkind1 5y ago
  But now do I have no way to access the S3 bucket not through cloudflare?
  - tialaramex 5y ago
    You know it's supposed to have a certificate from Cloudflare, so, you can choose to trust that certificate (knowing it is correct for this purpose) or you can use tooling that doesn't care. If you mean can you present it for general access by people on the Internet, no, not really, because the certificate aren't trusted, you would need a proxy layer.

r1ch 5y ago

Full does not check certificates, so a MITM can supply any untrusted certificate and intercept your traffic. Only Full (Strict) does trusted cert checking.

ewuhic 5y ago
"Can" theoretically, or there's a valid attack vector which one may pull off immediately in the wild?
- captn3m0 5y ago
  The current Airtel scenario is a good demonstration I’d say.
- r1ch 5y ago
  Cloudflare terminates SSL at the point closest to the user, so any of the ISPs between Cloudflare's POP and the origin could MITM the traffic. Normally an untrusted MITM cert would throw up a TLS error, but since the Cloudflare <-> End User part is trusted, a MITM attack with anything but Full (Strict) is undetectable to an end user. There's plenty of examples of ISPs trying this in the wild: https://www.zdnet.com/article/kazakhstan-government-is-now-intercepting-all-https-traffic/ https://www.zdnet.com/article/kazakhstan-government-is-now-i... https://www.reddit.com/r/sysadmin/comments/4vy3op/my_isp_is_trying_to_intercept_some_of_my_https/ https://www.reddit.com/r/sysadmin/comments/4vy3op/my_isp_is_... https://superuser.com/questions/176651/isp-replaces-ssl-certificates-any-solution https://superuser.com/questions/176651/isp-replaces-ssl-cert...
jrochkind1 5y ago
Huh, I didn't realize Full didn't check certs at all. Why don't they have a mode that checks that the cert is valid for hostname that you have configured cloudflare to access (which *.s3.amazonaws.com already has), rather than for the end-point that the destination isn't actually answering on directly itself? Or maybe I'm misunderstanding what was up, have to mess with it more.

sirshmooey 5y ago

Just use a free Cloudflare Origin CA certificate and set to strict. Encryption for the whole round trip unless someone accesses origin server directly. https://developers.cloudflare.com/ssl/origin-configuration/origin-ca https://developers.cloudflare.com/ssl/origin-configuration/o...

jrochkind1 5y ago
But now do I have no way to access the S3 bucket not through cloudflare?
- tialaramex 5y ago
  You know it's supposed to have a certificate from Cloudflare, so, you can choose to trust that certificate (knowing it is correct for this purpose) or you can use tooling that doesn't care. If you mean can you present it for general access by people on the Internet, no, not really, because the certificate aren't trusted, you would need a proxy layer.