I highly doubt anything cloudflare did resulted in that otherwise there would be very big outrage in

I highly doubt anything cloudflare did resulted in that otherwise there would be very big outrage in this discord right now and a lot of unhappy engineers having to work to get that fixed asap

UnsmartOP•5/18/23, 3:46 PM

So then they have invalid ssl certs on their end they need to fix. SSL certs dont last forever

UUnsmart I highly doubt anything cloudflare did resulted in that otherwise there would be...

lokiwind•5/18/23, 3:46 PM

Couldn't it have caused a different problem for everyone?

lokiwind•5/18/23, 3:47 PM

are you using plesk panel @znuff

lokiwind•5/18/23, 3:48 PM

delete and reinstall the ssl certificate

ZZnuff We have a few dozens domains pointed to our IP that we have dedicated for all re...

UnsmartOP•5/18/23, 3:48 PM

Is your SSL encryption mode set to "Flexible"? Thats the only option that will work with no cert on origin

lokiwind•5/18/23, 3:48 PM

let's encrypt ssl is free

Chaika•5/18/23, 3:51 PM

The IP you provide isn't a CF IP/not from a record proxied by Cloudflare, I assume? It's just their website proxied pointing at a normal server IP

Chaika•5/18/23, 3:52 PM

If your origin doesn't work over https at all, it would only have ever worked with Flexible. If the origin does work over https, and responds with an invalid (wrong domain, self-signed, etc), but only full and not full (strict)

Chaika•5/18/23, 3:54 PM

Just finding one which is broken would be enough, and seeing if switching back to Flexible fixes it

Chaika•5/18/23, 3:54 PM

For what it's worth, if you were relying on just Flexible before, it's completely insecure, just faking https

Chaika•5/18/23, 3:55 PM

ahh so it's likely your origin does respond with a cert, but just not one which is trusted

UnsmartOP•5/18/23, 3:56 PM

Error 526 only happens when the ssl setting is full ssl (strict) according to dev docs so that is the issue

UnsmartOP•5/18/23, 3:56 PM

https://developers.cloudflare.com/support/troubleshooting/cloudflare-errors/troubleshooting-cloudflare-5xx-errors/#error-526-invalid-ssl-certificate

Chaika•5/18/23, 3:56 PM

All of your customers use Cloudflare?

Chaika•5/18/23, 3:57 PM

There is one quirk with Cloudflare you could potentially take advantage of. If the customer proxies a CNAME record, Cloudflare is fine as long as the certificate it responds with contains the requested hostname, or the target hostname. If you have a record like custom-hostname.yoursite.com, all it has to do is have a valid cert for itself.

Chaika•5/18/23, 3:57 PM

In a perfect world though, you should really be using something like Cf for SaaS/a setup that issues a cert for each customer, like every other provider does

Chaika•5/18/23, 3:59 PM

Not too new, a quick search shows Cf started using it sometime in August 2022

Chaika•5/18/23, 3:59 PM

Some android browsers/old devices don't trust it though, the CA itself is somewhat new I believe, at least relative to the age of other roots

Chaika•5/18/23, 4:04 PM

CF's own "CA" (signed by Digicert) is going away. They've already stopped using it for Universals. There's an API-only endpoint you can use to ask it to switch your universal to a different CA, but your only other option I believe is Let's Encrypt, which uses a cross-sign to work on some older android devices that don't check cert expiration, but still broken on some other devices. I believe that endpoint doesn't instantly switch either, but just next renewal..?

ZZnuff The blog post mentions that this is actually a "backup" certificate

Chaika•5/18/23, 4:04 PM

Backups use GTS yea, but so do Universals now