Slashdot Mirror

← Back to Stories (view on slashdot.org)

CloudFlare Announces Free SSL Support For All Customers

Posted by Soulskill on from the big-step-in-the-right-direction dept.

Z80xxc! writes: CloudFlare, a cloud service that sits between websites and the internet to provide a CDN, DDOS and other attack prevention, speed optimization, and other services announced today that SSL will now be supported for all customers, including free customers. This will add SSL support to approximately 2 million previously unprotected websites. Previously SSL was only available to customers paying at least $20/month for a "Pro" plan or higher.

Browsers connect to CloudFlare's servers and receive a certificate provided by CloudFlare. CloudFlare then connects to the website's server to retrieve the content, serving as a sort of reverse proxy. Different security levels allow CloudFlare to connect to the website host using no encryption, a self-signed certificate, or a verified certificate, depending on the administrator's preferences. CloudFlare's servers will use SNI for free accounts, which is unsupported for IE on Windows XP and older, and Android Browser on Android 2.2 and older.

5 of 67 comments (clear)

  1. Re:In the Market by Z80xxc! · · Score: 5, Informative

    CloudFlare isn't a host, it's a sort of advanced CDN with extra features. You still need to have the website hosted on another server somewhere. Their website explains how it works better than I can, so you might as well read it there: https://www.cloudflare.com/ove...

  2. Re:In the Market by tepples · · Score: 3, Informative

    But if your site is behind a CDN proxy and highly cacheable, then you can probably get away with cheap hosting like WebFaction or something.

  3. Puts the hurt on StartSSL. Good on 'em! by Anonymous Coward · · Score: 2, Informative

    StartSSL has a business model of free non-commercial certificates, and their profit seems to stem from an archaic, non-user-friendly website with poor to no documentation, while revocation fees do in-fact cost real money for errors made. Real SSL Security I suppose, but at the cost of obfuscation, which ain't exactly free. And seriously, how long do they keep the passport scan, etc. you had to send them to get the free certificate on file? GeoTrust/RapidSSL or Comodo never asked me for a passport scan, etc.

    StartSSL wants a pile of documentation first though, and once they reject your certificate request, for example by deeming your purpose to be of a commercial nature, you're (seemingly) banned for life, (while they don't tell you how long they'll retain the documents you had to submit). Here's a guy that wrote a web page with his experience using StartSSL: http://danconnor.com/post/50f6... When I first read this, I was considering myself to be a normal customer trying to use free StartSSL certs. There's probably several more. After much time and effort, I have come to agree with the person who was so motivated to create that web page, (not that I'd go so far as to publish such a doc, but yeah, I gotta agree with 'em).

    Anyway, I'm just one of many it seems StartSSL has chosen not to business with, although after all this pain, they do sell a cheap wildcard certificate. I just wish I'd have purchased it cheap from the beginning, instead of all the %$#@! hoops to learn their bullshit model model so well, that I got accused of abusing their system by requesting too many free certs, (when I should have just bought a wildcard certificate, saving me a TON of time, tedium, and in the end money too) banned for life from doing business with StartSSL again, with all my documents retained in their files for an inexplicable time, (care to reply StartSSL folks?). How'd you like to be me?

    Thank goodness Cloudflare is open for business with what looks like a solid product. I think I'll walk across the street and look a closer at Cloudflare now. StartSSL closed the door on me, so I can't do business with them if I wanted to.

  4. Re:In the Market by Z80xxc! · · Score: 3, Informative

    Indeed. I run a couple websites that see a decent amount of traffic. CloudFlare up front, Webfaction on the backend. Works quite well overall. Very speedy load times and easy to set up. I'm looking forward to enabling SSL for all my sites. I have had some troubles getting the right IP addresses into logs and applications though... WebFaction's nginx reverse proxy adds an X-FORWARDED-FOR header, which replaces that sent by CloudFlare with the CloudFlare IP... so you end up not getting the right IP returned.

  5. Re:The illusion of security by Gerald · · Score: 3, Informative

    They discuss origin server encryption (the plaintext issue) in a follow-on blog post: https://blog.cloudflare.com/or...