Hacker News Reader

Comment by taf2 | Hacker News Reader

are you certain about needing a business plan, it looks to me that pro for $20/month also supports SSL? perhaps I'm missing an important bullet?

[update]: i am guessing from the language on the "SSL encryption type" bullet:

"CloudFlare-issued" vs "CloudFlare-issued or custom"

or custom must be what's required to host your own domain ssl cert?

View on HN

From my understanding, CloudFlare issued means they use their partner CA to generate you a certificate, while custom means you can source your own certificate and provide it to them.

They've already done as much checking for domain ownership as StartCom do, so they're free to issue you a certificate safely, especially as it will never leave their infrastructure.

I think, yes, that the "CloudFlare-issued" means you have to use a CloudFlare subdomain... But again I did not test. Even if it works, it's still twice as expensive as GAE, doesn't seem to cache the HTML files (as per above comment)...

It is a cloudflare subdomain but it doesn't show that way in the URL, I dont know how that works though. Can anybody explain why this works? I dont have a naked domain with ssl with them but you can check this one out to see what it looks like https://www.luckybolt.com (also thats my brothers startup, if you are in SF, check it out). As you point out though, GAE is $10 / Mo. cheaper. I'll check that out for new projects.

They basically generate the SSL certificate for your domain for you. Their SSL CA partner (GlobalSign IIRC) is basically trusting them with it since they manage their certificate and the domain owner is trusting Cloudflare (this can also be checked in Whois). So you just activate SSL in the options and bam, your site works with SSL within a couple of minutes.

BTW: they use certificates with multiple SANs, so many different domains in the same certificate (and without SNI). This allows to terminate SSL on a single box for many different domains/customers. If you look at certificates details, you will see many unrelated domains in the SAN list.

Reply on news.ycombinator.com