Cloudflare Developers•2y ago

well if it was unproxied it'd be your origin's control over min tls entirely

Yyev Anyone else have min TLS settings just straight up not take effect? We had 1.0 a...

ChaikaOP•8/6/24, 11:48 PM

Using R2 Custom Domains or Pages Custom Domains?

CChaika well if it was unproxied it'd be your origin's control over min tls entirely

yev•8/6/24, 11:48 PM

Yeah I'm working on adjusting on the server directly at this point but was hoping to get CF to kick back in on blocking support

yev•8/6/24, 11:50 PM

Case 500Nv00000CA3iVIAT

ChaikaOP•8/6/24, 11:52 PM

green names aren't employees, just volunteers, I can't see tickets. I would mention though that there is quite a few situations where it wouldn't obey your min tls settings. Any use of CF For SaaS, if you're using a partner like Render, Shopify, R2 Custom Domains or Pages Custom Domains don't use your setting. If it's a normal origin you have control over, wouldn't be that though

yev•8/6/24, 11:52 PM

Ah ok thank you

yev•8/6/24, 11:53 PM

I'm using a normal cf business account and a vps

yev•8/6/24, 11:54 PM

The setting was working fine and confirmed to be blocking 1.0 and 1.1 for more than a year but just stopped last week

yev•8/6/24, 11:54 PM

Nmap scans confirm support for the root domain but oddly not on www

Peps•8/6/24, 11:55 PM

what does https://www.ssllabs.com/ssltest/ say?

SSL Server Test (Powered by Qualys SSL Labs)

A comprehensive free SSL test for your public web servers.

ChaikaOP•8/6/24, 11:56 PM

yea might be a good idea to use one of those tools, or curl's --tls-max, haven't used nmap for that before

ChaikaOP•8/6/24, 11:56 PM

that's interesting though, and they're both proxied to the same destination, and you haven't used the API to create per hostname tls settings right?

yev•8/6/24, 11:58 PM

Fresh scan running. I have set cipher suites via API with the ACM in the past

yev•8/6/24, 11:59 PM

nmap --script ssl-cert,ssl-enum-ciphers -p 443 domain.tld

yev•8/7/24, 12:02 AM

This should display only the 1.2 ciphers I set but it lists 1.0 and 1.1 cipher suites too.

yev•8/7/24, 12:05 AM

Scan shows B with 1.0 and 1.1 support :/

Siddhant•8/7/24, 5:20 AM

Hi all.

Siddhant•8/7/24, 5:21 AM

Siddhant•8/7/24, 5:21 AM

I got this error. please help me to resolve

yev•8/7/24, 5:21 AM

Clear the cache of the tab with the button on the far left of the url bar.

yev•8/7/24, 5:22 AM

Either site settings and clear data or view cookies and delete or whatever, then try again

Siddhant•8/7/24, 5:25 AM

my email ID and password does not match. while requesting for the forgot password I got the above error.
Not able to request for new password. Can you suggest me ?

beat•8/7/24, 6:07 AM

The cdn anycast IP is located in the eastern part of the US and the real server is located in the western part of the US. What is the latency between east and west when a user is accessing from the east?

jasdf•8/7/24, 7:19 AM

Even though only Lets Encrypt, GTS, Sectigo and Digicert are the only CA's used by Cloudflare, can anyone explain why CAA records for ssl.com are being added automatically?

jasdf•8/7/24, 7:20 AM

300    IN    CAA    0 issue "ssl.com"
300    IN    CAA    0 issuewild "ssl.com"

300    IN    CAA    0 issue "ssl.com"
300    IN    CAA    0 issuewild "ssl.com"

Erisa•8/7/24, 7:32 AM

I don't think anyone has said anything for sure, but my understanding is that they're a new CA being added, can track https://github.com/cloudflare/cloudflare-docs/issues/15902

GitHub

SSL.com not being mentioned in CAA records · Issue #15902 · cloudfl...

Existing documentation URL(s) https://developers.cloudflare.com/ssl/edge-certificates/caa-records/#caa-records-added-by-cloudflare What changes are you suggesting? Hey

I noticed today in one of m...

playaz44•8/7/24, 7:44 AM

Hello, in Security->DDoS->Rule OverridesSecurity->DDoS->Rule Overrides I'm trying to change several available sets but when I try to save to any value I get this error it is not a valid override action (Code: 20067)it is not a valid override action (Code: 20067) What does it mean?

playaz44•8/7/24, 7:44 AM

it doesn't matter what action I choose, it's the same every time

playaz44•8/7/24, 7:45 AM

It seems that this error only occurs in the set with id a28fdadad47e4cb0ba5bf607de4ae4c2a28fdadad47e4cb0ba5bf607de4ae4c2

CS176•8/7/24, 9:09 AM

Just got hit with 1.25 billion DDoS attacks. Put the site into under attack mode. Is there anything else I should do to stay secure?

Flare•8/7/24, 9:18 AM

If you are under a DDoS attack then you can take a look at these threads for first steps and help with mitigation:

CS176•8/7/24, 9:34 AM

Much appreciated, I didn’t think about targeting the user agent and other identifiers. The requests are coming from MAC addresses all over the world, so when I first saw it on the events dashboard I was thinking I was going to be in a world of pain

Shiva Prasad•8/7/24, 9:40 AM

Hi Guys,

falcondive.dev is our website and we are using cloudflare to secure our website with Auto SSL and more.

We are getting different SSL certificates for different browsers in some systems.

We are getting Google Trust Services as CA when we use Firefox and Edge and getting Sophos as CA when we try to access it from Google Chrome in some systems.

In some systems, We are getting Google Trust Services as CA in all browsers.

We have not configured any firewall or host configs in any system.

Can someone help on this please...

Original message was deleted

Shiva Prasad•8/7/24, 9:45 AM

@FloppyDisk

Can you please explain indetail

Original message was deleted

Shiva Prasad•8/7/24, 9:53 AM

I am able to access it using Firefox and Edge, facing issue in google chrome only.

i dont remember configuring sophos or any firewall in it.

How can we know it?

Nimrod | Magma Devs🌋•8/7/24, 12:16 PM

Hey everyone,
Does anyone have insights on how to combine the benefits of dynamic steering (i.e., routing requests through the fastest pool) and proximity steering?
I have multiple servers located across Asia and the US. The two main load-balancing strategies I've considered are:

Proximity Steering: This involves creating a pool for each location and using least outstanding requests steering within each pool.
Pros:
Ensures even distribution of requests within the same region.
Routes traffic to the nearest general location, providing a macro-level optimization of latency.
Cons:
Suboptimal micro-level latency optimization—requests from Tokyo, for instance, might get routed to a server in Singapore due to broad geo- coordinates.
Dynamic Steering: Here, I would have a pool for each individual server.
Pros:
Routes requests to the server with the lowest latency for the user's location.
Cons:
Uneven load distribution—users in Tokyo would always be directed to Tokyo servers.

What would be the best way to combine these approaches to achieve an optimal balance (enterprise user)?

jasdf•8/7/24, 3:19 PM

Can someone please help me debug this issue please. general-helpJust switched a domain to Cloudflare Auth DNS. Getting NXDOMAIN for users on Quad9 Recursives.

Lytiut•8/8/24, 3:43 AM

rfenrih•8/8/24, 5:26 AM

not recieve email cloudflare email not working

rfenrih•8/8/24, 5:26 AM

please help

Siddhant•8/8/24, 6:03 AM

Hello I dont have existing email address domain@creationsoftnepal.com. Password reset link of cloudflare is sent to that email address. How can I change that email address? Please help

च

चायवाला•8/8/24, 10:37 AM

Hi, I'm very new to technical side of wordpress website.

Rn i am trying to connect my website to google search consol. and having issues in it. I know my DNS is in CF but dont know the account that it is in.
Rn the help i need is how can i fetch my domain to right CF account (i use only DNS of CF) and have access to google search consol.

let me know if anyone can help.
my dns is at cf but for some reason it says its not. wierd.

ziffermann•8/8/24, 1:27 PM

Hi everyone, I have a quick question regarding the limits for the URL scanner API.

I have a Pro plan and am trying to understand what limits are applied to me when using the URL scanner API:

On one side the global limit for the Cloudflare API is 1200 requests per five minutes. (https://developers.cloudflare.com/fundamentals/api/reference/limits/)
On another side the API Doc site says it is "1 new scan every 10 seconds and 8000 per month". (https://developers.cloudflare.com/api/operations/urlscanner-create-scan)
Finally, there is a table with scan limits which actually doesn't have the Pro plan (it has Free, Self serve, Enterprise, Cloudforce One). Which one is Pro? Is it really Self-serve? (https://developers.cloudflare.com/security-center/investigate/scan-limits/)

So, the question is what URL scanner limits apply to my case?

ziffermann•8/8/24, 1:38 PM

Ok, does it mean my URL scanner API limit is 5000 public scans per month (1 per 10 second) or it's 8000 per month? Is there a way to monitor the limit rates via API or a dashboard?

Aiden [Switched to @aidendotgg]•8/8/24, 3:37 PM

is there any way to see what permissions are needed for specific endpoints?

ChaikaOP•8/8/24, 3:37 PM

used to be in the old api docs, now it just guess or ask one of us who know a fair few

Aiden [Switched to @aidendotgg]•8/8/24, 3:38 PM

https://developers.cloudflare.com/api/operations/r2-delete-bucket

Cloudflare API Documentation

Interact with Cloudflare's products and services via the Cloudflare API

Aiden [Switched to @aidendotgg]•8/8/24, 3:38 PM

what would this require

ChaikaOP•8/8/24, 3:39 PM

Workers R2 Storage is a safe bet, R2 has its own interface for creating r2 scoped api keys but no clue if those work with the generic rest api if you scoped them

well if it was unproxied it'd be your origin's control over min tls entirely

Similar Threads

Similar Threads

Similar Threads