some of the workers projects I wrote were deleted :d
some of the workers projects I wrote were deleted :d
UI highly doubt anything cloudflare did resulted in that otherwise there would be very big outrage in this discord right now and a lot of unhappy engineers having to work to get that fixed asap
USo then they have invalid ssl certs on their end they need to fix. SSL certs dont last forever
LCouldn't it have caused a different problem for everyone?
Lare you using plesk panel @znuff
Ldelete and reinstall the ssl certificate
UIs your SSL encryption mode set to "Flexible"? Thats the only option that will work with no cert on origin
Llet's encrypt ssl is free
CThe IP you provide isn't a CF IP/not from a record proxied by Cloudflare, I assume? It's just their website proxied pointing at a normal server IP
CIf your origin doesn't work over https at all, it would only have ever worked with Flexible. If the origin does work over https, and responds with an invalid (wrong domain, self-signed, etc), but only full and not full (strict)
CJust finding one which is broken would be enough, and seeing if switching back to Flexible fixes it
CFor what it's worth, if you were relying on just Flexible before, it's completely insecure, just faking https
Cahh so it's likely your origin does respond with a cert, but just not one which is trusted
UError 526 only happens when the ssl setting is full ssl (strict) according to dev docs so that is the issue
CAll of your customers use Cloudflare?
CThere is one quirk with Cloudflare you could potentially take advantage of. If the customer proxies a CNAME record, Cloudflare is fine as long as the certificate it responds with contains the requested hostname, or the target hostname. If you have a record like custom-hostname.yoursite.com, all it has to do is have a valid cert for itself.
CIn a perfect world though, you should really be using something like Cf for SaaS/a setup that issues a cert for each customer, like every other provider does
CNot too new, a quick search shows Cf started using it sometime in August 2022
CSome android browsers/old devices don't trust it though, the CA itself is somewhat new I believe, at least relative to the age of other roots
CCF's own "CA" (signed by Digicert) is going away. They've already stopped using it for Universals. There's an API-only endpoint you can use to ask it to switch your universal to a different CA, but your only other option I believe is Let's Encrypt, which uses a cross-sign to work on some older android devices that don't check cert expiration, but still broken on some other devices. I believe that endpoint doesn't instantly switch either, but just next renewal..?
CBackups use GTS yea, but so do Universals now