That is a really interesting point.
When you install your SSL certificate on Cloudflare and point your DNS at them, you are essentially installing Cloudflare as a "man in the middle" between your visitors and your server.
Even if you have SSL between Cloudflare's servers and your in-house servers, there is technically still a point where Cloudflare terminates the SSL and can see all the traffic in plain text before they forward it on to your own servers.
That is a lot of trust to be putting in Cloudflare!
To be fair, though, it's just like working with any third party cloud provider. If you host on AWS, for example, you better believe sysadmins at AWS could look at all of your traffic, too, if they wanted to.
So no matter what you do, if you host in the cloud at scale instead of owning your infrastructure, you have to trust third parties.
most cloud providers have not posted that they will actively scan what your visitors read and write to send info to three letter agencies so that men with guns can decide if freedoms you or your visitors have had should continue.
It's even more interesting that the ssl and encryption stuff is so confusing that even tech focused professionals do not know it's possible - just because cloudflare is the dns used.
I guess that really means that the little lock icon in the url bar is a very false sense of whatever for 18% of the web.
recently trying to ban ip blocks from some bad actors, found I can't get their actual ip in my raw access logs. The really bad people just show up as cloudflare ips in the logs.
So I find a cpanel plugin that is to help, but it was once promoted by cloudflare and no longer supported. There is now some command line thing that needs install and some nano/vim to add cloudlfare things into it.. after a few rounds of trying to piece this together I found it much faster/simpler to disable cloudflare.
Besides Cloudflare panel (firewall) also shows IP addresses, And the bad faith actors can be blocked through that via rules. This works in the free version too.
[1]https://support.cloudflare.com/hc/en-us/articles/200170986-H...
> In the control panel for DNS setup you have an option called "Firewall", and within that option there is a setting called "Security level".
> By default it is set to "Medium", which means that a lot of people will be blocked from your website by a very annoying and time consuming CAPTCHA. And the problem with this option is that it cannot be disabled in the free service. You actually has to pay for the Enterprise edition, which is more that 200 dollars a month per domain, in order to disable the feature. Even if you set the setting to the lowest available value in the free service, which is Essentially off, many of your visitors will still be blocked.
> Your connection is only really encrypted up until the CloudFlare servers, after that the connection can simply be clear text. The connection is encrypted between the browser and CloudFlare, and between CloudFlare and the website if the website has a SSL certificate, but the communication in-between remains completely visible to CloudFlare.
> It means that sensitive data is being disclosed to CloudFlare without the consent or knowledge of your visitors.