Re:Use LetsEncrypt and CloudFlare to secure any Heroku app f...
by CiPHPerCoder on Thursday July 21, 2016 @10:05AM
(#12136892)
That's simultaneously wrong and misleading.
"The Cloud" isn't a company that has direct access to a certificate authority.
"The Cloud" doesn't produce a valid TLS certificate for YOUR website, to encrypt the connection between them and your visitors, but not necessarily between them and your server.
"The Cloud" is a vague term for "other people's computers".
CloudFlare is better than plaintext HTTP, but if your goal is confidentiality, then CloudFlare is probably worse than direct HTTPS with no intermediaries.
Again, threat models differ. For most people, CloudFlare is probably just fine.
"The Cloud" isn't a company that has direct access to a certificate authority.
"The Cloud" doesn't produce a valid TLS certificate for YOUR website, to encrypt the connection between them and your visitors, but not necessarily between them and your server.
"The Cloud" is a vague term for "other people's computers".
CloudFlare is better than plaintext HTTP, but if your goal is confidentiality, then CloudFlare is probably worse than direct HTTPS with no intermediaries.
Again, threat models differ. For most people, CloudFlare is probably just fine.