3 ms·

Yes, Cloudflare controls your DNS and they advertise setting up HTTPS for you. If they'd wait until you added a DNS record that's routed through them, which the

Yes, Cloudflare controls your DNS and they advertise setting up HTTPS for you. If they'd wait until you added a DNS record that's routed through them, which they are by default, then that'd be poor user experience. The timestamp difference is probably just Google backdating the certificate by an hour or 30 minutes to deal with clients whose clocks lag behind.

8organicbits 2y ago
What method do they use to get the certificate? I'd guess ACME DNS-01 challenge, but that means they are setting DNS records you didn't explicitly ask for. Getting a TLS certificate is pretty quick, I'd probably prefer to wait 10 seconds versus having unexpected DNS records. (edit: although I'm a DevOps engineer and I wrote my own subdomain registration service, so my preference will certainly not match others).
- fastball 2y ago
  Many (most?) registrars add DNS you didn't explicitly ask for, like an A record on the root that says "this domain was purchased from Namecheap" or whatever. Do you know of a registrar that doesn't do that?
  - rgrmrts 2y ago
    DNSimple doesn’t do that (https://dnsimple.com/ https://dnsimple.com/)
    - deleted 2y ago
      [deleted]
  - dmd 2y ago
    I've never used a registrar that does do that.
    - beeboobaa3 2y ago
      How would you know? It's not like those records are displayed in their configuration panel and the only way to request TXT records for e.g. a subdomain is to know that subdomain even exists ahead of time.
      - 8organicbits 2y ago
        If we're still talking about TLS certs, the transparency log has that info (mentioned in the article). I also assume this thread is talking about the domain and any subdomains you're actually using. What would the reason be of setting TXT records for unguessable subdomains?
        beeboobaa3 2y ago
        My comment was regarding DNS records, since this subthread switched to talking about DNS 2 comments up: > Many (most?) registrars add DNS you didn't explicitly ask for This relates to TLS since DNS records can be used to request a TLS certificate, but yes, those show in the certificate transparency log, so that you can check. But it won't tell you about other DNS records that may be used for various other purposes.
        8organicbits 2y ago
        Did you have any purposes in mind? An A record for the apex of the domain would be easy to find with dig or any other DNS client. I agree with the hypothetical though, your DNS provider can set records that you didn't request, could hide them in the console, and detecting these would be hard in the general case.
        beeboobaa3 2y ago
        Not really, the point is more that you wouldn't easily find out if they did that.
      - neurostimulant 2y ago
- jsheard 2y ago
  > that means they are setting DNS records you didn't explicitly ask for. If you make a CAA record on Cloudflare then they add extra invisible CAA records which authorize the ~4 different CAs they use for CDN certificates. They really assume you're using the whole stack, not just DNS.
- beeboobaa3 2y ago
  > but that means they are setting DNS records you didn't explicitly ask for Sure, that's what you're paying them for. Cloudflare is not a "dumb" domain registrar, they are an integrated service. > Getting a TLS certificate is pretty quick Most of the time, yes. Sometimes there are outages or whatever. It makes sense to just get it done ASAP. Distributing that TLS certificate to their edge network may take some time as well, and who knows what other internal prep they need to do.

8organicbits 2y ago

What method do they use to get the certificate? I'd guess ACME DNS-01 challenge, but that means they are setting DNS records you didn't explicitly ask for. Getting a TLS certificate is pretty quick, I'd probably prefer to wait 10 seconds versus having unexpected DNS records. (edit: although I'm a DevOps engineer and I wrote my own subdomain registration service, so my preference will certainly not match others).

fastball 2y ago
Many (most?) registrars add DNS you didn't explicitly ask for, like an A record on the root that says "this domain was purchased from Namecheap" or whatever. Do you know of a registrar that doesn't do that?
- rgrmrts 2y ago
  DNSimple doesn’t do that (https://dnsimple.com/ https://dnsimple.com/)
  - deleted 2y ago
    [deleted]
- dmd 2y ago
  I've never used a registrar that does do that.
  - beeboobaa3 2y ago
    How would you know? It's not like those records are displayed in their configuration panel and the only way to request TXT records for e.g. a subdomain is to know that subdomain even exists ahead of time.
    - 8organicbits 2y ago
      If we're still talking about TLS certs, the transparency log has that info (mentioned in the article). I also assume this thread is talking about the domain and any subdomains you're actually using. What would the reason be of setting TXT records for unguessable subdomains?
      - beeboobaa3 2y ago
        My comment was regarding DNS records, since this subthread switched to talking about DNS 2 comments up: > Many (most?) registrars add DNS you didn't explicitly ask for This relates to TLS since DNS records can be used to request a TLS certificate, but yes, those show in the certificate transparency log, so that you can check. But it won't tell you about other DNS records that may be used for various other purposes.
        8organicbits 2y ago
        Did you have any purposes in mind? An A record for the apex of the domain would be easy to find with dig or any other DNS client. I agree with the hypothetical though, your DNS provider can set records that you didn't request, could hide them in the console, and detecting these would be hard in the general case.
        beeboobaa3 2y ago
        Not really, the point is more that you wouldn't easily find out if they did that.
    - neurostimulant 2y ago
jsheard 2y ago
> that means they are setting DNS records you didn't explicitly ask for. If you make a CAA record on Cloudflare then they add extra invisible CAA records which authorize the ~4 different CAs they use for CDN certificates. They really assume you're using the whole stack, not just DNS.
beeboobaa3 2y ago
> but that means they are setting DNS records you didn't explicitly ask for Sure, that's what you're paying them for. Cloudflare is not a "dumb" domain registrar, they are an integrated service. > Getting a TLS certificate is pretty quick Most of the time, yes. Sometimes there are outages or whatever. It makes sense to just get it done ASAP. Distributing that TLS certificate to their edge network may take some time as well, and who knows what other internal prep they need to do.