Re:Universal SSL
by ultramancool on Monday September 29, 2014 @01:51PM
(#8384061)
Currently in "Full SSL" mode they take any self-signed certificate. No fingerprint confirmation or even pinning.
I use CF on multiple sites and generally love it, but this is one of their biggest shortcomings - I still need to buy certs if I don't want to get MITM'd.
I use CF on multiple sites and generally love it, but this is one of their biggest shortcomings - I still need to buy certs if I don't want to get MITM'd.