One question about renewing the certificates for SaaS, if the customer does not have the DNS at clou

One question about renewing the certificates for SaaS, if the customer does not have the DNS at cloudflare at all, and the method is Http, and the pki is avaliable, if i serve the .well-known, will it work?

RRares One question about renewing the certificates for SaaS, if the customer does not ...

Chaika•9/6/24, 7:06 PM

you don't need to serve the .well-known, it just does it for you

RaresOP•9/6/24, 7:06 PM

even if the custom hostname is not managed by Cloudflare?

RaresOP•9/6/24, 7:06 PM

let;s say the Customer has it at GoDaddy

RaresOP•9/6/24, 7:08 PM

This is what i see in the CF docs

If the custom hostname is not proxying traffic through Cloudflare, then the custom hostname domain owner will need to add the TXT or HTTP DCV token for the new certificate to validate and issue. As the SaaS provider, you will be responsible for sharing this token with the custom hostname domain owner.

If the custom hostname is not proxying traffic through Cloudflare, then the custom hostname domain owner will need to add the TXT or HTTP DCV token for the new certificate to validate and issue. As the SaaS provider, you will be responsible for sharing this token with the custom hostname domain owner.

RRares This is what i see in the CF docs ``` If the custom hostname is not proxying tr...

Chaika•9/6/24, 7:11 PM

That is about the original version for SSL for SaaS which was completely different and weird

Chaika•9/6/24, 7:12 PM

You can't use HTTP DCv for prevalidation (before they add the CNAME) for.. obvious reasons but see
https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/http/

Cloudflare is able to serve a random token from our edge due to the fact that site.example.com has a CNAME in place to $CNAME_TARGET, which ultimately resolves to Cloudflare IPs. If your customer has not yet added the CNAME, the CA will not be able to retrieve the token and the process will not complete.

We will attempt to retry this validation check for a finite period before timing out. Refer to Validation Retry Schedule for more details.

RRares even if the custom hostname is not managed by Cloudflare?

Chaika•9/6/24, 7:13 PM

the custom hostname is managed by Cloudflare since it points to your Cloudflare zone and goes through CF's CDN

RaresOP•9/6/24, 7:13 PM

So just tell the customer hey point your domain ar this CNAME and that is all?

RRares So just tell the customer hey point your domain ar this CNAME and that is all?

Chaika•9/6/24, 7:14 PM

It's an option. It's also how Pages and R2 work. It means there will be some downtime if they're switching providers before the cert is issued (and if they have CAA records blocking it, it might never work and therefor cause more downtime before you realize that, you could check for CAA records on your end tho/put them on the cname target hostname

Chaika•9/6/24, 7:15 PM

*Pages and R2 can avoid downtime if pointing to a CF zone because CF for SaaS will use your Universal or any adv/custom cert while the CF For SaaS one is pending

RaresOP•9/6/24, 7:18 PM

How can the caa be in the target hostname? All i was able to find on CAA is this, that the customer needs to add this 3 ones

https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/troubleshooting/

RRares How can the caa be in the target hostname? All i was able to find on CAA is this...

Chaika•9/6/24, 7:19 PM

you set CAA records up on your end on the hostname they point to

Chaika•9/6/24, 7:19 PM

customer.example.com -> fallback.saasprovider.com
fallback.saasprovider.com would have CAA records, those 3 it wants

Chaika•9/6/24, 7:20 PM

note: That would only work if they do not hide the CNAME, some DNS Providers offer ALIAS records to resolve the cname down to a/aaa records (and this is required for apex/root CNAMEs)

Chaika•9/6/24, 7:21 PM

CAA records follow CNAMEs. For more info on CAA record behavior: https://letsencrypt.org/docs/caa/

Certificate Authority Authorization (CAA)

CAA is a type of DNS record that allows site owners to specify which Certificate Authorities (CAs) are allowed to issue certificates containing their domain names. It was first standardized in 2013, and the version we use today was standardized in 2019 by RFC 8659 and RFC 8657. By default, every public CA is allowed to issue certificates for any...

Chaika•9/6/24, 7:23 PM

it's not something required by any means, but it could help you avoid the situation where you have a customer who has CAA records on their domain restricting your issuance

RaresOP•9/6/24, 7:23 PM

Ah, thank you very much on your help

RaresOP•9/6/24, 7:28 PM

In CF the tag should be only allows specific hostnamesonly allows specific hostnames ?

Chaika•9/6/24, 7:43 PM

For the caa yea

RaresOP•9/6/24, 8:02 PM

so it would look like this right?

Ttforster Hey folks, is there a dedicated Tunnels channel? I searched and I can't find any...

Hello, I’m Allie!•9/6/24, 10:08 PM

#cf1-general

4d62•9/6/24, 10:38 PM

Hey there, I configured an access policy to only allow certain emails but when I test it I can connect using other emails (also tried on app not just test page). am I doing something wrong

4d62•9/6/24, 10:39 PM

Setting allowed domains to @mydomain.ca and @mydomain.org just gives me the following:

4d62•9/6/24, 10:43 PM

I added Get a login code emailed to youGet a login code emailed to you and now access policies seem to apply as intended. is this an intended feature or a bug?

bcBread•9/6/24, 10:55 PM

bcBread•9/6/24, 10:56 PM

question about using a cloudflare worker for hosting metadata and getting an error if there are any devs in here or someone can point me in the right direction

OrangeSky•9/7/24, 12:12 AM

Hello! I just added a website to cloudflare and it is timming out. This is a website hosted at AWS. Is there a trick to make it work? https://mortgageloansaz.com/

doy.tech•9/7/24, 8:19 AM

Hi, so what're the differences between Jekyll (for Github) and wrangler for CF?

Zenith Rifle•9/7/24, 8:30 AM

hello

suport_php•9/7/24, 9:10 AM

hello

suport_php•9/7/24, 9:11 AM

I use Telekom Romania internet with IP 178.138.33.238, I cannot acces Cloudflare IPs [188.114.96.3] [188.114.97.3] from several days.

suport_php•9/7/24, 9:12 AM

it's ISP problem?

Idle•9/7/24, 9:28 AM

i'm not quite sure what you mean with accessing those IPs

Idle•9/7/24, 9:29 AM

those are 2 US colo IPs (as far as i can tell), are you trying to directly dial them?

suport_php•9/7/24, 9:31 AM

Ping statistics for 188.114.97.3:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)

suport_php•9/7/24, 9:31 AM

Telekom users cannot access Cloudflare sites with those class IPs

Original message was deleted

Idle•9/7/24, 9:32 AM

Idle•9/7/24, 9:34 AM

what do you mean by that

suport_php•9/7/24, 9:36 AM

Screenshot_2024-09-07-12-35-18-632_com.android.chrome.jpg

Idle•9/7/24, 9:36 AM

Original message was deleted

Idle•9/7/24, 9:36 AM

looks like they were trying to do exactly what i asked

suport_php•9/7/24, 9:41 AM

ok, thanks.

o7•9/7/24, 12:22 PM

is there a dashboard metric for amount of data downloaded/ingressed vs served, for file uploads

disector•9/7/24, 3:43 PM

Hello, how long does a startup apply response take?
I applied on September 1 and I still haven't gotten a response.

Ddisector Hello, how long does a startup apply response take? I applied on September 1 and...

DaniFoldi•9/7/24, 9:25 PM

I'd say more than a week, the team probably got many entries

DDaniFoldi I'd say more than a week, the team probably got many entries

disector•9/7/24, 9:26 PM

I understand, do you know if it is rejected/approved, do they still send the confirmation to the email?

If the custom hostname is not proxying traffic through Cloudflare, then the custom hostname domain owner will need to add the TXT or HTTP DCV token for the new certificate to validate and issue. As the SaaS provider, you will be responsible for sharing this token with the custom hostname domain owner.

One question about renewing the certificates for SaaS, if the customer does not have the DNS at clou

Similar Threads

Similar Threads

Similar Threads