The Cloudflare blog post about how they tried to work-around it is a pretty good explainer on the underlying issue. http://blog.cloudflare.com/ssl-on-custom-dom

The Cloudflare blog post about how they tried to work-around it is a pretty good explainer on the underlying issue. http://blog.cloudflare.com/ssl-on-custom-domains-for-appengine-and-other http://blog.cloudflare.com/ssl-on-custom-domains-for-appengi... >>>Here's a bit of detail on the core problem. SSL is tied to a particular domain and, usually, an IP address. Managing SSL certificates in an elastic cloud environment is non-trivial. As a result, many cloud providers don't support SSL at all or, like AppEngine, create a wildcard SSL cert for their domain and force everyone who wants SSL to send requests to that. Unfortunately, if you try and make a request to AppEngine from your own domain then the SSL certificate won't validate. We initially thought we could solve this as a proxy just by ignoring SSL errors from the origin, but AppEngine also routes based on the host header. If the host header isn't a subdomain off appspot.org then traffic gets rerouted to the Google home page.