3 ms·

If this is HTTPS, how would Cloudfare have the certificate for your domain so that browsers don't warn about a mismatch? Or is it that when you sign over DNS t

If this is HTTPS, how would Cloudfare have the certificate for your domain so that browsers don't warn about a mismatch? Or is it that when you sign over DNS to a provider, they can take over your cert? They can "ass-cert" their own? :)

threecheese 2mo ago
As far as I know they terminate all TLS; it’s one of the tradeoffs using them.
- muvlon 2mo ago
  They have a product called Magic Transit that offers DDoS protection and such for plain IP traffic, where Cloudflare does not terminate TLS. Pricing is not public but starts in the five-digit USD per month range according to people I talk to. This may tell you something about how keen Cloudflare are to handle traffic they themselves cannot decrypt.
  - bawolff 2mo ago
    Magic Transit uses BGP magic to work. That only makes sense at scale - i believe you have to have your own ASN for it to work. Realistically its a totally different product, and 5 digit price is probably cheap relative to competitors in that space.
    - muvlon 2mo ago
      Nope, you don't need your own AS for this to work, nor do you need to use BGP. They support static routes too. BGP peering support is actually "beta" according to Cloudflare: https://developers.cloudflare.com/magic-transit/get-started/#ips https://developers.cloudflare.com/magic-transit/get-started/... You do ideally want your own /24, though even that's not a hard requirement. And it can be provider-assigned space as long as your provider is willing to sign an LOA for you. As for competitors, there are a few that start in the low 4 digits per month for similar services. That's not to say Cloudflare doesn't have anything unique to offer though, they're great at scale and standardization.
      - bawolff 2mo ago
        would a provider really be willing to sign an LoA for you in that situation? That seems like a hard ask, but admittedly this is out of my depth.
bawolff 2mo ago
Yes, the person who controls the DNS controls the certificate. What a certificate is supposed to verify is that traffic is going to the right place. If you designate cloudflare as the rightful host of your website then they can get a certificate. This isn't an edge case though. This is cloudflare's primary product. It is why users use them.

threecheese 2mo ago

As far as I know they terminate all TLS; it’s one of the tradeoffs using them.

muvlon 2mo ago
They have a product called Magic Transit that offers DDoS protection and such for plain IP traffic, where Cloudflare does not terminate TLS. Pricing is not public but starts in the five-digit USD per month range according to people I talk to. This may tell you something about how keen Cloudflare are to handle traffic they themselves cannot decrypt.
- bawolff 2mo ago
  Magic Transit uses BGP magic to work. That only makes sense at scale - i believe you have to have your own ASN for it to work. Realistically its a totally different product, and 5 digit price is probably cheap relative to competitors in that space.
  - muvlon 2mo ago
    Nope, you don't need your own AS for this to work, nor do you need to use BGP. They support static routes too. BGP peering support is actually "beta" according to Cloudflare: https://developers.cloudflare.com/magic-transit/get-started/#ips https://developers.cloudflare.com/magic-transit/get-started/... You do ideally want your own /24, though even that's not a hard requirement. And it can be provider-assigned space as long as your provider is willing to sign an LOA for you. As for competitors, there are a few that start in the low 4 digits per month for similar services. That's not to say Cloudflare doesn't have anything unique to offer though, they're great at scale and standardization.
    - bawolff 2mo ago
      would a provider really be willing to sign an LoA for you in that situation? That seems like a hard ask, but admittedly this is out of my depth.

bawolff 2mo ago

Yes, the person who controls the DNS controls the certificate. What a certificate is supposed to verify is that traffic is going to the right place. If you designate cloudflare as the rightful host of your website then they can get a certificate. This isn't an edge case though. This is cloudflare's primary product. It is why users use them.