Hacker News Reader

What do you mean?

You can install certificates by cloudflare and then the only one that can connect to your server is from cloudflare.

No one can intercept it then.

If you're talking about flexible SSL. Sure, you can use it purely as a https proxy for your SEO score of your blog. But securing it is not much effort.

If it's just for a static blog, I'm not sure what you would though.

View on HN

If you have a valid HTTPS certificate for example.com and then add example.com to Cloudflare, your overall security decreases because the path from the CF datacenter to your origin is now vulnerable to MITM - the default SSL setting is "Full" which doesn't check certificate validity.

To the less experienced sysadmin everything looks like it's working fine and users also don't notice any difference, which is why it's a terrible default.

Sure you _can_ configure Cloudflare securely, but it should be secure out of the box. But that adds friction when the origin doesn't have a valid SSL certificate which probably hurts someone's KPIs.

Reply on news.ycombinator.com