Encrypt End-To-End

Hello,

I am trying to setup ( Full Strict End-to-End )
The main domain "domain1.com" work perfectly but the "domain2.com" that is only a redirect to "domain1.com" are facing a 526 Cloudflare error when activating because it is not part of the SSL Certificate.

Is this possible to create a Origin Server Certificate and adding all redirected domain to it to prevent this error ?

Thanks,

jdp•8/7/23, 3:24 PM

Just curious, why would you need to Full(Strict) if the domain only serves to redirect.

jdp•8/7/23, 3:24 PM

It'd just be redirecting anyways to the main domain which has Full(Strict) on

jdp•8/7/23, 3:25 PM

You have no orgin on Domain2, so Full(Strict) on would not work anyways afaik

jdp•8/7/23, 3:26 PM

You can turn it on Flexible and just have Automatic HTTPs Rewrite enabled

jdp•8/7/23, 3:26 PM

and it'll still use Full(Strict) once it redirects

GGeeXx Hello, I am trying to setup ( Full Strict End-to-End ) The main domain "domain1...

Chaika•8/8/23, 2:54 AM

You can do the redirect entirely within Cloudflare, if I understand you correctly. Either with Page Rules, Bulk Redirects, or Dynamic Redirects.
For simple redirects, Bulk Redirects may be the easiest: https://developers.cloudflare.com/rules/url-forwarding/bulk-redirects/create-dashboard/

Is this possible to create a Origin Server Certificate and adding all redirected domain to it to prevent this error ?

Origin Certs can only contain a singular specific zone/domain in your account. If you can do the redirect logic in one of the redirect products, great! You could also use a custom Worker if it's more complex.

Create Bulk Redirects in the dashboard · Cloudflare Rules docs

To create Bulk Redirects in the Cloudflare dashboard you must:

Jjdp You can turn it on Flexible and just have Automatic HTTPs Rewrite enabled

Chaika•8/8/23, 2:54 AM

never ever ever flexible, never. Even for redirects, it would allow anyone to MITM the connection and serve a malicious redirect

CChaika never ever ever flexible, never. Even for redirects, it would allow anyone to MI...

Vector•8/10/23, 2:52 AM

Chances of that are unlikely for such a small website.

Vector•8/10/23, 2:52 AM

I doubt this dude owns a business the size of Apple

Vector•8/10/23, 2:53 AM

or works for such

Vector•8/10/23, 2:53 AM

Yeah, good security practice, but a MITM attack is so unlikely and even then if you can do a MITM Attack you can do a much harsher attack on the person ratted.

Vector•8/10/23, 2:53 AM

Plus they'll end up visiting Google and seeing something is wrong

VVector Chances of that are unlikely for such a small website.

Hello, I’m Allie!•8/10/23, 7:11 AM

I mean, it’s more just like, unless you have legacy infra that absolutely cannot work over HTTPS, there isn’t really a good reason to use Flexible.

Hello, I’m Allie!•8/10/23, 7:11 AM

Sure, in most cases, you won’t need it, but why take that chance?

Encrypt End-To-End

Similar Threads

Similar Threads

Similar Threads