Hacker News Reader

Comment by spoiler | Hacker News Reader

To be fair, Cloudflare is also the reason why most sites even have TLS at all, because it offered free certs (through letsencrypt I think?) in a fairly easy to set up way.

Certs used to be expensive, and had way more operational overhead and quirks (even setting up ACME/LE)

View on HN

Absolutely not, no. That is all thanks to Let's Encrypt.

This was true before Let's Encrypt existed, they'd buy massive 500 domain wildcard SSL certs that free users would split.

Cloudflare has native integration with Let's encrypt, which makes using TLS with a CDN much easier than if you had to acquire the ACME cert and deploy it to the CDN yourself.

Granted, most CDNs these days have some form of free certicate system, but that wasn't always the case.

Let's Encrypt is unusable for me because they want you to install that certbot thing. I don't know what that is or what it does. I don't want some magical auto update thing. Is it so hard to just make a generate button that gives you cert.pem and pkey.pem? Cloudflare managed to do it.

Let's encrypt supports ACME. Here are hundreds of ways to obtain a certificate:

https://letsencrypt.org/docs/client-options/#other-client-op...

Right, DoctorOW correct me; I have limited memory about the state of affairs from a decade ago. They offered free certs for a long time regardless of LE integration

People on this website will just type any wild lie. I kinda love it.

The sky is purple! Charlie Brown had hoes! Cloudflare invented Let's Encrypt! Just say anything you want! We live in a post-truth world- there's no need for anything you say to correspond to any external reality!

Congrats! You get it!

> this website

you must be new to the internet...

I'm pretty sure Lincoln said that first...

I never said Cloudflare was behind Let's Encrypt… Did I? Probably just a misunderstanding.

Someone l pointed out I mixed up my timeline a bit because this was over a decade ago, but it turns out CF offered free certs even earlier than LE :)

So, while i got the details wrong, I still stand behind what I say: most sites on the web even have TLS enabled because CF offers it for free. I'm not talking about the reverse proxy aspect, but from the UA's perspective

I'm not going to give them credit for the work that Lets Encrypt did.

I agree, Let’s encrypt and ACME played a massive role. But it’s still far easier having Cloudflare handle TLS encryption for you.

And i say this as someone who uses ACME in certmanager and certbot at home and still prefers the ease with which Cloudflare generates a cert for my domain and terminates TLS for the public side of my cloudflare tunnel.

For my home stuff I just use nginx-proxy-manager and haven't thought about it since I set it up a couple of years ago.

For work, I used to use certbot directly at my old place. Now I am building my new stuff on k8s, and I have the ingress manage my certs for me (likely using certbot or similar behind the scenes). Both have been extremely low setup effort and no ongoing effort.

I don't like giving Cloudflare my (or my companies/customers) data in exchange for being able to click a checkbox.

Lets Encrypt can proxy my old http only website to show as https? Without access to server configuration? How?

With nginx-proxy-manager which uses Let's Encrypt for certs you can... This isn't the gotcha you think it is.

I don't have access to the server.

It can be run anywhere. You don't need it on the same server. Cloudflare isn't running on the same server either.

Cloudflare is a checkbox.

And you only let them see every bit of traffic to and from your site in exchange.

What a deal.

You changed the subject btw.

I didn't. I said that Cloudflare is the one that allowed my http only site to become https.

My bad! I slightly confused my timeline. CF offered free certs long before LE!

Reply on news.ycombinator.com