Cloudflare Developers•2y ago

It exposes your origin directly for that hostname/record, and you lose the CDN, Protection, Caching,

It exposes your origin directly for that hostname/record, and you lose the CDN, Protection, Caching, etc

ChaikaOP•3/1/24, 8:27 PM

You'd only benefit from CF's super fast DNS

AAshley Is https://blog.cloudflare.com/secrets-store in beta yet, or any news on it? As ...

Bruce Lee•3/1/24, 8:27 PM

I'm looking for info on this as well. These would be a fantastic feature for an app I'm working on, and currently I've just stubbed out a service that dumps stuff into R2 until this becomes available.

CChaika It exposes your origin directly for that hostname/record, and you lose the CDN, ...

b-bear•3/1/24, 8:28 PM

okay, by protection that means ddos and waf?

ChaikaOP•3/1/24, 8:28 PM

Yes, you have no ddos/waf from CF on an unproxied record

b-bear•3/1/24, 8:28 PM

got it ty

faye•3/1/24, 10:38 PM

So, I got a new UI on the workers & pages screen, but only on one of the pages, not the other ones. Is this a feature? A bug?
I also cannot view real-time logs anymore :(

faye•3/1/24, 10:41 PM

Well, the new UI seems to come to other pages now, but the not being able to view the logs is a bug I suppose
also one of the other pages that got the new UI just broke? lol

faye•3/1/24, 10:41 PM

so random

Walshy•3/1/24, 10:46 PM

that errors shows if there's no Function

Walshy•3/1/24, 10:46 PM

isn't related to ui work

Walshy•3/1/24, 10:47 PM

https://i.walshy.dev/id6wJSgle2RU3Q0X8Q.png

Walshy•3/1/24, 10:47 PM

logs working fine for me

WWalshy that errors shows if there's no Function

faye•3/1/24, 10:54 PM

I got functions though

faye•3/1/24, 10:55 PM

Also the entire site is like.. really broken and I have not a single clue why this is happening, just shows a 404 page (from notFound() in nextjs), on a static page? :2HAhaa:

SSciCat Hello, I was interested maybe someone can give me some insight. Have anyone used...

dave•3/2/24, 12:36 AM

we use Cloudflare R2 heavily as a data store for most of our Google Cloud Run projects.

KNOX•3/2/24, 4:07 AM

quick little question reguarding DNS

I know on cloudflare you have do subdomains like
subdomain.example.comsubdomain.example.com
but can you do
something.subdomain.example.comsomething.subdomain.example.com

KKNOX quick little question reguarding DNS I know on cloudflare you have do subdomain...

ChaikaOP•3/2/24, 4:09 AM

The only issue you'd hit, if it it was a web service you wanted to proxy, the default SSL/TLS Certificate Cloudflare gives you for free, which is your Universal Certificate, is a simple wildcard *.example.com, and wouldn't cover anything deeper then the first level

ChaikaOP•3/2/24, 4:10 AM

You'd have to buy ACM (Adv. Cert Manager). Some Cloudflare products which offer Custom Domains like Pages, R2 Custom Domains, Worker Custom Domains, issue you certificates that would cover that if you were using them

KNOX•3/2/24, 4:11 AM

i see, thank you so much. I've tried to do it before but just could never get it to work. let me try to see if my ssl provider will allow it

ChaikaOP•3/2/24, 4:12 AM

well the issue isn't your provider but Cloudflare, if you want it proxied/to take advantage of Cloudflare's CDN/Caching/DDoS Protection that is

ChaikaOP•3/2/24, 4:12 AM

You could unproxy it and lose that all, and then you'd just need your provider to issue a certificate covering that

KNOX•3/2/24, 4:13 AM

so if i proxy it id have to use cloudflares ssl? sorry if im not understanding

ChaikaOP•3/2/24, 4:15 AM

Right. Proxy uses Cloudflare's SSL Certificate, which you get a Universal one for free, which is a simple wildcard and covers your apex (

*.example.com

*.example.com

example.com

example.com

). Because of how SSL Certificates work, wildcards only ever cover one label or level of subdomains. You'd need a certificate covering *.subdomain.example.com*.subdomain.example.com or something.subdomain.example.comsomething.subdomain.example.com exact for it to work.
With Proxy enabled with a secure configuration, you need valid SSL at both ends
Visitor <- Cloudflare SSL -> Cloudflare <- Origin/Provider SSL -> Origin

ChaikaOP•3/2/24, 4:19 AM

The DNS system is based off a hierarchy, separated by dots. comcom is operated by Versign,

example.com

example.com

is delegated/controlled by someone else, test2.example.comtest2.example.com could also be controlled/operated by someone else. Different levels can be controlled by different people, part of the reason why there's special rules around it like with SSL Certificates.

You could, for example, do something-subdomain.example.comsomething-subdomain.example.com, using

rather then

, and you would have no issue with Cloudflare SSL covering it, the wildcard

*.example.com

*.example.com

universal certificate would cover it.

KNOX•3/2/24, 4:24 AM

so even if i have my own ssl for it cloudflare proxy wouldn't allow it?

KKNOX so even if i have my own ssl for it cloudflare proxy wouldn't allow it?

ChaikaOP•3/2/24, 4:26 AM

Saying "it wouldn't allow it" is kind of implying CF is purposefully not allowing it. That's not the case. It's just that Cloudflare does not have a certificate by default which would cover/be valid for a subdomain deeper then the first level. You'd have to buy ACM and specifically issue a certificate (*.subdomain.example.com*.subdomain.example.com or something.subdomain.example.comsomething.subdomain.example.com), which would. Otherwise you'd just get cipher mismatch errors as CF doesn't have a certificate which would be valid to serve for that.

ChaikaOP•3/2/24, 4:27 AM

(and Cloudflare needs to have its own valid certificate as it needs to be able to inspect the request for security/waf/firewall reasons, and be able to return responses, like block pages, without involving your origin. If it didn't have its own SSL, it wouldn't be able to do that)

KNOX•3/2/24, 4:32 AM

ahh, so even with my own ssl, id still need the ACM. Does ACM cover any of the sub.sub.example.com's i make. or would i have to make one for each?

KKNOX ahh, so even with my own ssl, id still need the ACM. Does ACM cover any of the s...

ChaikaOP•3/2/24, 4:35 AM

Fundamentally SSL Certificate Wildcards only go one level deep. You can't issue *.*.example.com*.*.example.com certificates for example, that's not valid. Wildcards always has to be on the left-most side, and only covers that same level.
so

*.example.com

*.example.com

-> covers sub.example.com, but not sub.sub.example.com (two levels),
*.sub.example.com*.sub.example.com -> covers sub.sub.example.com, but not sub.sub2.example.com, or example.sub2.sub.example.com

ChaikaOP•3/2/24, 4:36 AM

ACM allows you to issue 100 advanced certificates, and each certificate can have up to 50 wildcards or hostnames, but I'd say if you need more then a few wildcards you're doing something wrong/should reconsider your approach. For example, doing sub-sub2.example.comsub-sub2.example.com rather then sub.sub2.example.comsub.sub2.example.com or just naming things differently

KNOX•3/2/24, 4:38 AM

ahh. alrighty!!! thank you so much.

So it'd just be best to sub-sub2.example.com instead of sub.sub2.example.com

ChaikaOP•3/2/24, 4:43 AM

Pretty much, no need for ACM then either

KNOX•3/2/24, 4:43 AM

thats true. Thank you so so so much for taking the time to answer my questions!!!!

ChaikaOP•3/2/24, 4:46 AM

Of course, sorry if I was a bit confusing. When it comes to Proxy, you can think of it as two completely seperate connections are made. One from User -> CF, one from CF -> Origin/your provider/web host. Both need certificates/ssl, the Origin one could be completely different then the User -> Cf one depending on your settings (origin rules can override port, SSL Mode "Flexible" could make the one to your origin insecure over http, etc)

KNOX•3/2/24, 4:49 AM

No it was fine!!! it was actually a really good explanation!! I've just never used more than one level for my domain. So this second level is new to me and you explained it really well!!!

KNOX•3/2/24, 4:50 AM

But in the midst of this i ran into a slight issue regarding something else haha

KNOX•3/2/24, 4:51 AM

when going to cancel a subscription and clicking Reason not listedReason not listed no text box for a written reason appears

KNOX•3/2/24, 4:51 AM

Screenshot_2024-03-01_at_10.47.54_PM.png

Screenshot_2024-03-01_at_10.50.09_PM.png

ChaikaOP•3/2/24, 4:53 AM

does it work if you pick a different one like "website no longer active"?

ChaikaOP•3/2/24, 4:54 AM

iirc that issue has been around forever, since Oct at least. One of those minor things no one has bothered to write up a report about because it's easy to get around but annoying. Should though at some point

KNOX•3/2/24, 4:55 AM

i mean i think it canceled my plan regardless but it was just a oh moment you know?

ChaikaOP•3/2/24, 4:56 AM

You should see under the Billing Subscriptions tab "Ending On", ex:

KNOX•3/2/24, 4:57 AM

It does say that so yeah it still works it just also returns an error

ChaikaOP•3/2/24, 4:57 AM

which subscription was that for? Argo?

KNOX•3/2/24, 4:58 AM

AMC

KNOX•3/2/24, 4:58 AM

i decided to listen to you and just do sub-sub2.example.com instead of sub.sub2.example.com

ChaikaOP•3/2/24, 4:58 AM

yea not really worth paying $10/month just for it to look a bit prettier

KNOX•3/2/24, 4:59 AM

yeah thats true. and im in college so every dollar counts haha

LordSilver•3/2/24, 6:53 AM

do workers expose a webhook that you can call?

It exposes your origin directly for that hostname/record, and you lose the CDN, Protection, Caching,

Similar Threads

Similar Threads

Similar Threads