4 ms·

Putting that mapping in /etc/hosts lets your machine skip DNS lookup for that hostname, and just use his IP for that domain name. Then, your browser checks the

by gojomo 13y ago

Putting that mapping in /etc/hosts lets your machine skip DNS lookup for that hostname, and just use his IP for that domain name. Then, your browser checks the received certificate against the authenticated TLS connection, and sees that all is well, allowing you to connect without a warning. Since the browser does not warn of a certificate mismatch, he must have a valid certificate for 'cloudflarechallenge.com'. QED.

alex_marchant 13y ago
But seems like only the http connection is working, i get a warning in Chrome when visiting https://cloudflarechallenge.com https://cloudflarechallenge.com. Isn't that the only situation where the key would be checked. That's the part that doesn't make sense.
- fletchowns 13y ago
  Try https://www.cloudflarechallenge.com/ https://www.cloudflarechallenge.com/
- nolok 13y ago
  Subdomains are separate domains, and you put www.cloudflarechallenge.com in your hosts, so when going to the domain without the www subdomain your entry in the hosts is not used. Either go to https://www.cloudflarechallenge.com https://www.cloudflarechallenge.com or remove the www subdomain from your hosts entry.
- gojomo 13y ago
  Try setting 'www.cloudflarechallenge.com' in /etc/hosts instead, and when visiting the URL hit <shift>-<reload> to ensure your browser isn't caching anything. I see Indutny's blog for 'https://www.cloudflarechallenge.com'[/etc/hosts https://www.cloudflarechallenge.com'[/etc/hosts mapped to 165.225.128.15] in both FF and Chrome.
  - alex_marchant 13y ago
    Ok adding www to the hosts entry worked, appreciate it
- quasque 13y ago
  Also possible to verify using OpenSSL commandline: openssl s_client -connect 165.225.128.15:443 -showcerts \ -servername www.cloudflarechallenge.com (Though to fully check, you need to compare certificates with the one off the real site, and ensure that his blog appears upon an HTTP request - to exclude proxying.)

by gojomo 13y ago

alex_marchant 13y ago

But seems like only the http connection is working, i get a warning in Chrome when visiting https://cloudflarechallenge.com https://cloudflarechallenge.com. Isn't that the only situation where the key would be checked. That's the part that doesn't make sense.

fletchowns 13y ago
Try https://www.cloudflarechallenge.com/ https://www.cloudflarechallenge.com/
nolok 13y ago
Subdomains are separate domains, and you put www.cloudflarechallenge.com in your hosts, so when going to the domain without the www subdomain your entry in the hosts is not used. Either go to https://www.cloudflarechallenge.com https://www.cloudflarechallenge.com or remove the www subdomain from your hosts entry.
gojomo 13y ago
Try setting 'www.cloudflarechallenge.com' in /etc/hosts instead, and when visiting the URL hit <shift>-<reload> to ensure your browser isn't caching anything. I see Indutny's blog for 'https://www.cloudflarechallenge.com'[/etc/hosts https://www.cloudflarechallenge.com'[/etc/hosts mapped to 165.225.128.15] in both FF and Chrome.
- alex_marchant 13y ago
  Ok adding www to the hosts entry worked, appreciate it
quasque 13y ago
Also possible to verify using OpenSSL commandline: openssl s_client -connect 165.225.128.15:443 -showcerts \ -servername www.cloudflarechallenge.com (Though to fully check, you need to compare certificates with the one off the real site, and ensure that his blog appears upon an HTTP request - to exclude proxying.)