Free MitM attack.
Enough reason not to.
https://scotthelme.co.uk/tls-conundrum-and-leaving-cloudflar... https://stirling.co/blog/cloudflare-mitm/
Re:CloudFlare, We Have a Problem
by manigandham on Saturday July 16, 2016 @03:39PM
(#12107592)
These are posts that always repeat the same thing: don't use Flexible SSL. Fine, that's your choice as the site operator to use or not use that option. Why blame the provider for your configuration choice?
No, they don't. At least one of those posts is specifically about Full SSL, as is my article. You cannot proxy through CloudFlare without an MITM risk, by design. No matter how you configure it.
Re:CloudFlare, We Have a Problem
by manigandham on Saturday July 16, 2016 @07:52PM
(#12108349)
Just like every other CDN or network service out there that is a proxy. Using a load balancer from a cloud provider that does TLS termination is the same risk. Of course it's by design because that's just how it works. You can't proxy TLS traffic without being MITM.
Please stop repeating the same exact thing instead of actually understanding what you're talking about, it's just misinformation and FUD at this point. You still havent replied to any of the other questions.
Letsencrypt?
Re:CloudFlare, We Have a Problem
by dredmorbius on Saturday July 16, 2016 @06:21AM
(#12105864)
TBF that's only just getting started. Sites have been up for a while.
While true, StartCom and WoSign have been around for a while (even if they have some shadiness issues of their own).
I wouldn't necessarily hold it against somebody to have picked CloudFlare because of this in the past, but in 2016 it's simply no longer a reason to keep using CF.
Enough reasons for me.