Hacker News Reader

Comment by zaroth | Hacker News Reader

This is great, but just two concerns. CloudFlare just generated itself certs for how many domains? And you don't really have a secure connection but the browser will report that you do.

View on HN

They do actually give you the ability to make this totally secure. They mentioned in the post that they will provide instructions on how to install a CloudFlare certificate on your server - this will allow CloudFlare to communicate securely with your server as it attempts to cache your content.

Then when the user makes the request to CloudFlare, they return the content that they received over SSL, on an SSL connection. It's like magic.

CloudFlare just made a HGUE impact on the internet, IMO.

Since the vast majority of their customers will not implement the full loop, it seems the huge impact will be further confusing the implications of seeing "https" in the browser.

CloudFlare doesn't act as the RA, they serve a validation file for the CA's bot to see before issuance.

It sure reads as they genereated 2mio+ certs - that's probably why they thank GlobalSign and Comodo in the blog post.

I'm not sure how I should feel, if company x (where I am a registered but non-paying customer in their free tier) gets a cert in my name withouth asking before.

A cert in your domain name. Something they could always do. As can anyone you've given control of your domain to. Domain validation is how most certificates are issued.

They could have done that by MITM the validation email you mean?

EDIT: Ah, there are more options than email validation - my CA didn't offer those. Learned something, thanks.

No. Email is not the only supported method of domain validation.

See, for example, Comodo's documentation: https://support.comodo.com/index.php?/Default/Knowledgebase/...

Reply on news.ycombinator.com