3 ms·

I think one of the misconceptions is about how cloudflare works. Their networking/routing is based on cheap routing your stuff in the free tier ( eg. Assets).

I think one of the misconceptions is about how cloudflare works. Their networking/routing is based on cheap routing your stuff in the free tier ( eg. Assets). This is done at the cheapest location/datacenter for cloudflare depending on usage/capacity in nearby datacenters. Performance/nearby for paying customers, cheap routing for free tiers. This helps bring usage to their underused datacenters too. If you want to bring your own certificate, you aren't letting cloudflare decide on how to route the files and are using a direct line, circumventing costs reductions they implemented. Because of that, i think they require you to be on the business tier, if you want to use your own certificate. Additionally, this requirement is almost solely for professional clients too. Can someone from cloudflare correct me if I'm wrong? It's just my 2 cents. Note: cheap doesn't mean slow. It mostly means that you won't be routed to a datacenter that is almost at capacity.

duskwuff 5y ago
> If you want to bring your own certificate, you aren't letting cloudflare decide on how to route the files and are using a direct line, circumventing costs reductions they implemented. I'm not sure there's any technical reason for this feature being on the paid tier. Domains on the free tier have their own SSL certificates too -- they're just certificates which Cloudflare issued internally, rather than ones provided by the customer.
- NicoJuicy 5y ago
  Those SSL certificates are issued by cloudflare. The route from cloudflare to the server is without ssl. So i think that makes it possible for cloudflare to cache things on the same domain, but different locations. No? Since i don't think they can cache things when you use your own SSL certificate.
  - duskwuff 5y ago
    > The route from cloudflare to the server is without ssl. That's a user preference, but the most common configuration uses SSL on the back-end (Cloudflare to server) connection. > Since i don't think they can cache things when you use your own SSL certificate. I don't see any reason why that would be the case.
    - NicoJuicy 5y ago
      Since cloudflare doesn't have the private key in this case.
      - duskwuff 5y ago
        Under most configurations, Cloudflare does have the private key. They act as an HTTP proxy, not a TLS proxy. Cloudflare does support a "keyless SSL" mode [1] for enterprise customers, but this only applies to the certificate private key -- the session key for each TLS session is still under Cloudflare's control, so they still have access to the contents of the HTTPS session. [1]: https://www.cloudflare.com/ssl/keyless-ssl/ https://www.cloudflare.com/ssl/keyless-ssl/
snowwrestler 5y ago
Generally when you bring your own TLS cert to a CDN, you upload the private key to them. Then, they copy that into their infrastructure and you gain the benefits of the CDN. If you’re not going to do that, there is no benefit to using a CDN. Just send all the traffic to your origin and run your own reverse proxy there.
- yjftsjthsd-h 5y ago
  > If you’re not going to do that, there is no benefit to using a CDN. Just send all the traffic to your origin and run your own reverse proxy there. You still get DoS protection.

duskwuff 5y ago

> If you want to bring your own certificate, you aren't letting cloudflare decide on how to route the files and are using a direct line, circumventing costs reductions they implemented. I'm not sure there's any technical reason for this feature being on the paid tier. Domains on the free tier have their own SSL certificates too -- they're just certificates which Cloudflare issued internally, rather than ones provided by the customer.

NicoJuicy 5y ago
Those SSL certificates are issued by cloudflare. The route from cloudflare to the server is without ssl. So i think that makes it possible for cloudflare to cache things on the same domain, but different locations. No? Since i don't think they can cache things when you use your own SSL certificate.
- duskwuff 5y ago
  > The route from cloudflare to the server is without ssl. That's a user preference, but the most common configuration uses SSL on the back-end (Cloudflare to server) connection. > Since i don't think they can cache things when you use your own SSL certificate. I don't see any reason why that would be the case.
  - NicoJuicy 5y ago
    Since cloudflare doesn't have the private key in this case.
    - duskwuff 5y ago
      Under most configurations, Cloudflare does have the private key. They act as an HTTP proxy, not a TLS proxy. Cloudflare does support a "keyless SSL" mode [1] for enterprise customers, but this only applies to the certificate private key -- the session key for each TLS session is still under Cloudflare's control, so they still have access to the contents of the HTTPS session. [1]: https://www.cloudflare.com/ssl/keyless-ssl/ https://www.cloudflare.com/ssl/keyless-ssl/

snowwrestler 5y ago

Generally when you bring your own TLS cert to a CDN, you upload the private key to them. Then, they copy that into their infrastructure and you gain the benefits of the CDN. If you’re not going to do that, there is no benefit to using a CDN. Just send all the traffic to your origin and run your own reverse proxy there.

yjftsjthsd-h 5y ago
> If you’re not going to do that, there is no benefit to using a CDN. Just send all the traffic to your origin and run your own reverse proxy there. You still get DoS protection.