How can they automatically provision a certificate? Do they run or partner with a CA that doesn't require validation by the actual domain owner?
Edit: If so, then what little trust still existed in the HTTPS PKI CA space just went out the window.
Edit: If so, then what little trust still existed in the HTTPS PKI CA space just went out the window.
Is there no way this is open to abuse? Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks? Maybe it's no different than regular automatic domain validation though.
Hopefully the backend that requests and retrieves new SSL certificates from the CA cannot be compromised.
You need to point the your domain to CloudFlare nameserver. I don't think you can do that unless you actually control the domain.
This is what makes me hesitant about using cloudflare or recommending it to clients; you give up a lot of control over your data and domains.
You're always at the mercy of at least one vendor, unless you own your own block of IP addresses and advertise it via BGP (and even then, someone could make their own malicious advertisement of your IP block).
You can't eliminate the risk. At some point, you have to set the threshold for what risk you consider acceptable. For many organizations, using Cloudflare provides enough benefit to outweigh the slightly higher risk of something going wrong.
Unless you're using DNSSEC..!
Everyone here likely knows on a cognitive level that SSL is pretty damn broken, but being reminded of the fact still feels rather disconcerting.
https://cabforum.org/wp-content/uploads/Baseline_Requirement...
"The CA MUST ensure that the certificate is issued with the consent of, and according to procedures established by, the owner of each Domain Name"
EDIT: Here are the established authorization procedures:
"11.1.1 Authorization by Domain Name Registrant
For each Fully-Qualified Domain Name listed in a Certificate, the CA SHALL confirm that, as of the date the Certificate was issued, the Applicant (or the Applicant’s Parent Company, Subsidiary Company, or Affiliate, collectively referred to as “Applicant” for the purposes of this section) either is the Domain Name Registrant or hascontrol over the FQDN by:
1. Confirming the Applicant as the Domain Name Registrant directly with the Domain Name Registrar;
2. Communicating directly with the Domain Name Registrant using an address, email, or telephone number provided by the Domain Name Registrar;
3. Communicating directly with the Domain Name Registrant using the contact information listed in the WHOIS record’s “registrant”, “technical”, or “administrative” field;
4. Communicating with the Domain’s administrator using an email address created by pre-pending ‘admin’, ‘administrator’, ‘webmaster’, ‘hostmaster’, or ‘postmaster’ inthe local part, followed by the at-sign (“@”), followed by the Domain Name, which may be formed by pruning zero or more components from the requested FQDN;
5. Relying upon a Domain Authorization Document;
6. Having the Applicant demonstrate practical control over the FQDN by making an agreed-upon change to information found on an online Web page identified by a uniform resource identifier containing the FQDN; or 7. Using any other method of confirmation, provided that the CA maintains documented evidence that the method of confirmation establishes that the Applicant is the Domain Name Registrant or has control over the FQDN to at least the same level of assurance as those methods previously described. "
IANAL and I'm sure that CF has had this double checked, but I still think it's a bold move to issue certs on their own account.
CloudFlare arguably has the consent of the domain holder (gray area but probably in CF's favor) and can pass the required validation.
I do partially agree that the domain holder (CloudFlare's customer) should have been sent an opt-in email, but I think the positives outweigh the negatives.