News for hackers. Stuff that matters.

A comment on CloudFlare, We Have a Problem. Parent comment

Re:CloudFlare, We Have a Problem by jraedisch on Saturday July 16, 2016 @02:22AM (#12105458)
What about using self-signed (and thereby untrusted) certificates?
[ Parent | on HN ]
Re:CloudFlare, We Have a Problem by narsil on Saturday July 16, 2016 @03:03AM (#12105546)
Why do this when letsencrypt.org provides free trusted SSL certs?
[ Parent | on HN ]
Re:CloudFlare, We Have a Problem by brianwawok on Saturday July 16, 2016 @02:09PM (#12107300)
There are missing edge cases with this.

Say I want to serve a static HTML website from a Google cloud storage over SSL. No way to do this for free with let's encrypt. 1 click and free with cloud flare.

Is there MITM chance between cloud flare and Google? Yes. For a static website with no login or input from users, seems safer than any free alternative I know of.

[ Parent | on HN ]
Re:CloudFlare, We Have a Problem by true_religion on Saturday July 16, 2016 @04:15PM (#12107722)
Doesn't Google offer a generic domain for you to use, like amazon has s3.amazon.com with some information about your username in the URL or subdomain?
[ Parent | on HN ]
Re:CloudFlare, We Have a Problem by jlgaddis on Saturday July 16, 2016 @05:53PM (#12108024)
Even if they do, how do you expect to get a valid (i.e. trusted) certificate for an FQDN that ends with ".google.com"?
[ Parent | on HN ]
Re:CloudFlare, We Have a Problem by brianwawok on Sunday July 17, 2016 @05:16PM (#12111869)
No you host from your own domain.

https://cloud.google.com/storage/docs/hosting-static-website

Gives you a site at your name.com

Only missing link is the HTTPS which you get with cloud flare

[ Parent | on HN ]
Re:CloudFlare, We Have a Problem by true_religion on Saturday July 16, 2016 @06:08PM (#12108067)
I'd expect they'd use something like star-certs, and give you a heyuser.storagegcd.com
[ Parent | on HN ]
Re:CloudFlare, We Have a Problem by jlgaddis on Sunday July 17, 2016 @02:21PM (#12111120)
Forgive my ignorance, but what is a "star-cert"?
[ Parent | on HN ]
Re:CloudFlare, We Have a Problem by true_religion on Sunday July 17, 2016 @08:15PM (#12112559)
Oh I think I just used a bit of jargon there. It's canonically called a Wildcard Certificate [0]

[0] https://en.wikipedia.org/wiki/Wildcard_certificate

[ Parent | on HN ]
Re:CloudFlare, We Have a Problem by cm2187 on Saturday July 16, 2016 @02:51AM (#12105518)
If CloudFlare pins the certificates then fine, but if it doesn't, you might as well leave the traffic unencrypted.
[ Parent | on HN ]