3 ms·
> If you want to bring your own certificate, you aren't letting cloudflare decide on how to route the files and are using a direct line, circumventing costs red
by duskwuff 5y ago
> If you want to bring your own certificate, you aren't letting cloudflare decide on how to route the files and are using a direct line, circumventing costs reductions they implemented.
I'm not sure there's any technical reason for this feature being on the paid tier. Domains on the free tier have their own SSL certificates too -- they're just certificates which Cloudflare issued internally, rather than ones provided by the customer.
- NicoJuicy 5y agoThose SSL certificates are issued by cloudflare. The route from cloudflare to the server is without ssl. So i think that makes it possible for cloudflare to cache things on the same domain, but different locations. No? Since i don't think they can cache things when you use your own SSL certificate.
- duskwuff 5y ago> The route from cloudflare to the server is without ssl. That's a user preference, but the most common configuration uses SSL on the back-end (Cloudflare to server) connection. > Since i don't think they can cache things when you use your own SSL certificate. I don't see any reason why that would be the case.
- NicoJuicy 5y agoSince cloudflare doesn't have the private key in this case.
- duskwuff 5y agoUnder most configurations, Cloudflare does have the private key. They act as an HTTP proxy, not a TLS proxy. Cloudflare does support a "keyless SSL" mode [1] for enterprise customers, but this only applies to the certificate private key -- the session key for each TLS session is still under Cloudflare's control, so they still have access to the contents of the HTTPS session. [1]: https://www.cloudflare.com/ssl/keyless-ssl/ https://www.cloudflare.com/ssl/keyless-ssl/