so even if i have my own ssl for it cloudflare proxy wouldn't allow it?

KKNOX so even if i have my own ssl for it cloudflare proxy wouldn't allow it?

Chaika•3/2/24, 4:26 AM

Saying "it wouldn't allow it" is kind of implying CF is purposefully not allowing it. That's not the case. It's just that Cloudflare does not have a certificate by default which would cover/be valid for a subdomain deeper then the first level. You'd have to buy ACM and specifically issue a certificate (*.subdomain.example.com*.subdomain.example.com or something.subdomain.example.comsomething.subdomain.example.com), which would. Otherwise you'd just get cipher mismatch errors as CF doesn't have a certificate which would be valid to serve for that.

Chaika•3/2/24, 4:27 AM

(and Cloudflare needs to have its own valid certificate as it needs to be able to inspect the request for security/waf/firewall reasons, and be able to return responses, like block pages, without involving your origin. If it didn't have its own SSL, it wouldn't be able to do that)

KNOXOP•3/2/24, 4:32 AM

ahh, so even with my own ssl, id still need the ACM. Does ACM cover any of the sub.sub.example.com's i make. or would i have to make one for each?

KKNOX ahh, so even with my own ssl, id still need the ACM. Does ACM cover any of the s...

Chaika•3/2/24, 4:35 AM

Fundamentally SSL Certificate Wildcards only go one level deep. You can't issue *.*.example.com*.*.example.com certificates for example, that's not valid. Wildcards always has to be on the left-most side, and only covers that same level.
so

*.example.com

*.example.com

-> covers sub.example.com, but not sub.sub.example.com (two levels),
*.sub.example.com*.sub.example.com -> covers sub.sub.example.com, but not sub.sub2.example.com, or example.sub2.sub.example.com

Chaika•3/2/24, 4:36 AM

ACM allows you to issue 100 advanced certificates, and each certificate can have up to 50 wildcards or hostnames, but I'd say if you need more then a few wildcards you're doing something wrong/should reconsider your approach. For example, doing sub-sub2.example.comsub-sub2.example.com rather then sub.sub2.example.comsub.sub2.example.com or just naming things differently

KNOXOP•3/2/24, 4:38 AM

ahh. alrighty!!! thank you so much.

So it'd just be best to sub-sub2.example.com instead of sub.sub2.example.com

Chaika•3/2/24, 4:43 AM

Pretty much, no need for ACM then either

KNOXOP•3/2/24, 4:43 AM

thats true. Thank you so so so much for taking the time to answer my questions!!!!

Chaika•3/2/24, 4:46 AM

Of course, sorry if I was a bit confusing. When it comes to Proxy, you can think of it as two completely seperate connections are made. One from User -> CF, one from CF -> Origin/your provider/web host. Both need certificates/ssl, the Origin one could be completely different then the User -> Cf one depending on your settings (origin rules can override port, SSL Mode "Flexible" could make the one to your origin insecure over http, etc)

KNOXOP•3/2/24, 4:49 AM

No it was fine!!! it was actually a really good explanation!! I've just never used more than one level for my domain. So this second level is new to me and you explained it really well!!!

KNOXOP•3/2/24, 4:50 AM

But in the midst of this i ran into a slight issue regarding something else haha

KNOXOP•3/2/24, 4:51 AM

when going to cancel a subscription and clicking Reason not listedReason not listed no text box for a written reason appears

KNOXOP•3/2/24, 4:51 AM

Screenshot_2024-03-01_at_10.47.54_PM.png

Screenshot_2024-03-01_at_10.50.09_PM.png

Chaika•3/2/24, 4:53 AM

does it work if you pick a different one like "website no longer active"?

Chaika•3/2/24, 4:54 AM

iirc that issue has been around forever, since Oct at least. One of those minor things no one has bothered to write up a report about because it's easy to get around but annoying. Should though at some point

KNOXOP•3/2/24, 4:55 AM

i mean i think it canceled my plan regardless but it was just a oh moment you know?

Chaika•3/2/24, 4:56 AM

You should see under the Billing Subscriptions tab "Ending On", ex:

KNOXOP•3/2/24, 4:57 AM

It does say that so yeah it still works it just also returns an error

Chaika•3/2/24, 4:57 AM

which subscription was that for? Argo?

KNOXOP•3/2/24, 4:58 AM

AMC

KNOXOP•3/2/24, 4:58 AM

i decided to listen to you and just do sub-sub2.example.com instead of sub.sub2.example.com

Chaika•3/2/24, 4:58 AM

yea not really worth paying $10/month just for it to look a bit prettier

KNOXOP•3/2/24, 4:59 AM

yeah thats true. and im in college so every dollar counts haha

LordSilver•3/2/24, 6:53 AM

do workers expose a webhook that you can call?

Ddave we use Cloudflare R2 heavily as a data store for most of our Google Cloud Run pr...

SciCat•3/2/24, 9:30 AM

How is the eggress?

charl.dev•3/2/24, 9:53 AM

Is there a channel dedicated to partner program or someone we can speak to/dm

</Wolf>•3/2/24, 11:20 AM

someone help?

SSciCat How is the eggress?

dave•3/2/24, 11:27 AM

It’s great, it’s at a reduced rate too compared to regular internet traffic from Google Cloud.

Original message was deleted

</Wolf>•3/2/24, 11:41 AM

with this https://ptb.discord.com/channels/595317990191398933/1213066981968969738

kai_194170•3/2/24, 1:07 PM

someone can help me? there is certain mails to my domain that are not sucessfully receive by my domain

Original message was deleted

Erisa•3/2/24, 3:45 PM

Can't give you timing but I can say it's in private alpha and actively worked on

Original message was deleted

Erisa•3/2/24, 3:45 PM

No, what benefit would this bring?

Isaac McFadyen•3/2/24, 3:50 PM

The dash might not be very useful as a PWA anyway because literally everything that it does requires an API call or similar.

faye•3/2/24, 4:36 PM

Me talking to the CF support AI be like:

Ahmed Qadeer•3/2/24, 6:58 PM

Hi Ahmed here .
After the domain ceritifcate is updated automatically by cloudflare today some of our clients are not able to access our domain saying the certificate was not issued by trusted authority does anyone what can be the issue

Ahmed Qadeer•3/2/24, 6:58 PM

This is the error they are getting

Isaac McFadyen•3/2/24, 7:00 PM

This is an incredibly old system and is likely due to the fact that Cloudflare issues certificates compatible with modern hardware using services such as Google Trust Services and Lets Encrypt.

Isaac McFadyen•3/2/24, 7:01 PM

I expect that OS to be so old that the certificate that is issued by Cloudflare is just not usable with that OS at all.

AAhmed Qadeer Hi Ahmed here . After the domain ceritifcate is updated automatically by cloudfl...

Hello, I’m Allie!•3/2/24, 7:02 PM

Hey, just removed your screenshot, since it appears to have included some personal information that you may not wish to share

Ahmed Qadeer•3/2/24, 7:04 PM

sorry

Ahmed Qadeer•3/2/24, 7:13 PM

Ahmed Qadeer•3/2/24, 7:13 PM

this is the certificate info when i hit from browser

Ahmed Qadeer•3/2/24, 7:14 PM

its successfully validated on chrome

Ahmed Qadeer•3/2/24, 7:14 PM

but not from ibm websphere

Erisa•3/2/24, 7:15 PM

https://developers.cloudflare.com/ssl/reference/browser-compatibility/

Cloudflare Docs

Browser compatibility · Cloudflare SSL/TLS docs

Review information about browser compatibility for the different Cloudflare SSL/TLS offerings.

Unsmart•3/2/24, 7:15 PM

damn ibm websphere is older than me

Erisa•3/2/24, 7:16 PM

You may need to issue an Advanced Cert from a different CA or upload a Custom Cert, both are paid features. The free Universal SSL is not designed to support old clients

EErisa You may need to issue an Advanced Cert from a different CA or upload a Custom Ce...

Ahmed Qadeer•3/2/24, 7:18 PM

okay i can do that but is it possible that it was working from some years and suddenly gets updated and stops working on them

Erisa•3/2/24, 7:19 PM

It was probably using digicert before, which was deprecated

so even if i have my own ssl for it cloudflare proxy wouldn't allow it?

Similar Threads

Similar Threads

Similar Threads