Cloudflare Developers•15mo ago

Can you force a renewal of certs with letsencrypt?

DDavid Wang Can you force a renewal of certs with letsencrypt?

lucidplot•10/23/24, 10:27 PM

certbot renewcertbot renew https://eff-certbot.readthedocs.io/en/stable/using.html#renewing-certificates

David WangOP•10/23/24, 10:27 PM

Ty. I figured they would already know how or at least be able to look it up

fry69•10/23/24, 10:33 PM

You only need to get your own certificates via Let's Encrypt/cerbot when you bypass the Cloudflare proxy, which degrades Cloudflare to basically a simple DNS zone manager.

David WangOP•10/23/24, 10:40 PM

Well it's either LE cert or installing CF cert, no?

David WangOP•10/23/24, 10:40 PM

If you turn on proxy and set ssl to full you still need a cert on the origin

fry69•10/23/24, 10:43 PM

Yes, but why use LE when you can use a 15 year lifetime cert generated from Cloudflare that even comes with its own CA, so your server can authenticate the connection via client auth and deny any other attempt to communicate with the raw webserver? ("Authenticated Origin Pulls")

David WangOP•10/23/24, 10:46 PM

Arguably certbot is easier to use for beginners. Plus i'm lazy to move over

fry69•10/23/24, 10:46 PM

Of course you should block the raw HTTP ports anyway when behind the Cloudflare proxy, e.g. with ->

for cfip in `curl -sw '\n' https://www.cloudflare.com/ips-v{4,6}`; do ufw allow from $cfip to any port 443 comment 'Cloudflare IP'; done

for cfip in `curl -sw '\n' https://www.cloudflare.com/ips-v{4,6}`; do ufw allow from $cfip to any port 443 comment 'Cloudflare IP'; done

David WangOP•10/23/24, 10:47 PM

Where does that go?

David WangOP•10/23/24, 10:47 PM

Oh. Ran as a bash script?

fry69•10/23/24, 10:48 PM

Sets up the ufwufw firewall to allow only Cloudflare IPs to the local HTTPS port

David WangOP•10/23/24, 10:49 PM

I'm gonna need to modify that for iptables

fry69•10/23/24, 10:50 PM

Generating the certs and installing them is pretty easy IMHO, as easy as setting up LE certs with nginx and you do not have to run certbot ever.

David WangOP•10/23/24, 10:50 PM

Still need to be done manually, no?

DDavid Wang I'm gonna need to modify that for iptables

fry69•10/23/24, 10:50 PM

ufwufw is a simple frontend for iptables, very common.

David WangOP•10/23/24, 10:50 PM

Also i have a a reverse proxy container on 3 VPSs that handles LE certs automatically, so that's actually easier

Ffry69 `ufw` is a simple frontend for iptables, very common.

David WangOP•10/23/24, 10:51 PM

But not universal, which is my point. I don't think any of my VPSs have it installed

DDavid Wang But not universal, which is my point. I don't think any of my VPSs have it insta...

fry69•10/23/24, 10:51 PM

Any debian/ubuntu box should have ufwufw installed IMHO

David WangOP•10/23/24, 10:51 PM

Eh. Unnecessary overhead to me

fry69•10/23/24, 10:53 PM

Well Cloudflare is also "unnecessary", but makes life so much easier.

David WangOP•10/23/24, 10:53 PM

People would disagree with the WAF rules and ddos protection

DDavid Wang People would disagree with the WAF rules and ddos protection

fry69•10/23/24, 10:56 PM

Unnecessary overhead when you just want raw performance, like writing your own iptables scripts

David WangOP•10/23/24, 10:57 PM

Um. No. Cf handling the firewall and ddos protection takes the overhead off the server

David WangOP•10/23/24, 10:57 PM

Although i heard proxying adds time to the request cycle. Is that right?

DDavid Wang Um. No. Cf handling the firewall and ddos protection takes the overhead off the ...

fry69•10/23/24, 11:00 PM

As long as you have an origin server which serves stuff you need to administrate that, e.g. with tools that are available there. I can only recommend to a have a look at ufwufw, it is pretty simple and very useful for these tasks. Also helps avoiding yourself shooting in the foot, aka locking yourself out by accident.

David WangOP•10/23/24, 11:01 PM

So far my foot is free of bullet holes

David WangOP•10/23/24, 11:01 PM

I've heard of ufw but i don't see the need for it

DDavid Wang Although i heard proxying adds time to the request cycle. Is that right?

fry69•10/23/24, 11:02 PM

Of course a proxy adds latency and processing time when the request needs to get forwarded to the origin server, but if static content can get cached by the proxy, it reduces this overhead, so it should be in almost all cases advantageous.

David WangOP•10/23/24, 11:02 PM

Having CF proxy on doesn't automatically mean caching is on, does it?

DDavid Wang Having CF proxy on doesn't automatically mean caching is on, does it?

fry69•10/23/24, 11:04 PM

If your origin server sends content with correct cache flags, I'd be surprised if the CF proxy would not cache those

fry69•10/23/24, 11:05 PM

You can turn the cache off in a "development mode"

fry69•10/23/24, 11:08 PM

Looks like 4h cache time is default for a standard proxy setup

David WangOP•10/23/24, 11:10 PM

Hm. Ok

David WangOP•10/23/24, 11:10 PM

I'll have to look into that

RyanKnack•10/23/24, 11:58 PM

This is a full documentation of CF's default caching behavior.

This is useful cuz if you need specialized caching behavior, this can tell you where to look and what to cache if you need it in your use case

https://developers.cloudflare.com/cache/concepts/default-cache-behavior/

Cloudflare Docs

Default cache behavior | Cloudflare Cache (CDN) docs

Cloudflare respects the origin web server’s cache headers in the following order unless an Edge Cache TTL cache rule overrides the headers. Refer to the Edge TTL section for details on default TTL behavior.

fry69•10/24/24, 12:04 PM

Oh, Workflows are in beta now -> https://discord.com/channels/595317990191398933/1040420029080018945/1298979412099989566 (blog announcement is not yet online or the URL is wrong)
Update: -> https://blog.cloudflare.com/building-workflows-durable-execution-on-workers/ is now online
See also this new channel -> workflows

The Cloudflare Blog

Build durable applications on Cloudflare Workers: you write the Wor...

Cloudflare Workflows is now in open beta! Workflows allows you to build reliable, repeatable, long-lived multi-step applications that can automatically retry, persist state, and scale out. Read on to learn how Workflows works, how we built it on top of Durable Objects, and how you can deploy your first Workflows application.

Original message was deleted

fry69•10/24/24, 1:02 PM

Great, it is online now, thanks.

VVikash I can’t complete cloudflare captchas because of error 600010

Felipe Souza•10/24/24, 2:30 PM

Same error here. What did you execute to solve this issue?

Sercan•10/24/24, 2:43 PM

anyone knows that when face detection will be announced to public (no accepts to private beta) as described here ? https://blog.cloudflare.com/whats-next-for-cloudflare-media/#optimize-images-of-people-with-automatic-face-cropping-for-cloudflare-images

The Cloudflare Blog

What’s new with Cloudflare Media: updates for Calls, Stream, and Im...

With Cloudflare Calls in open beta, you can build real-time, serverless video and audio applications. Cloudflare Stream lets your viewers instantly clip from ongoing streams. Finally, Cloudflare Images now supports automatic face cropping and has an upload widget that lets you easily integrate into your application.

Nelson Sousa•10/24/24, 5:19 PM

Hi everyone, first time looking into this flow. Let's imagine that a website has an option to upload an image. Let's say that image goes into Cloudflare R2 or some other cloud storage.

Is there a way to automatically trigger some event to transform this original image into multiple ones, with different sizes? Let's say 100x100, 200x200, etc? Without a proper backend running, but allowing us to pre-processing it?

I was thinking in something like a Cloudflare worker as a service, which triggers somehow on a new image upload and generate new ones, with some lib and finally uploading them into R2 again.

Am I in a fog or is this something doable and okayish? I'd need a free plan to test this, so alternatives like Cloudflare Images aren't really an option right now, afaik. Thank you

Idle•10/24/24, 5:36 PM

:confusedpixeljoe:

マ

マイケル•10/24/24, 5:43 PM

Nelson Sousa•10/24/24, 5:43 PM

TL;DR: transform original image into multiple ones with different sizes. Save on Cloudflare R2. Pre-processing (not at each request)

NNelson Sousa Hi everyone, first time looking into this flow. Let's imagine that a website has...

valkyrie_pilot•10/24/24, 5:58 PM

i think the biggest problem is doing it on upload

valkyrie_pilot•10/24/24, 5:58 PM

if you can upload through a server this is super easy

Nelson Sousa•10/24/24, 5:58 PM

But then the server is the one responsible for getting the image and pre-processing it, in the same sync flow, right?

Cryofuel•10/24/24, 5:58 PM

Hello beautiful people.
I am looking to sign up for the pro account that includes WAF.
https://www.cloudflare.com/en-gb/application-services/products/waf/

One question though - am I understanding the documentation correctly that custom TLS are supported and I only need the Business Account if I want to buy certificates from CloudFlare directly ?
https://developers.cloudflare.com/ssl/edge-certificates/custom-certificates/

CCryofuel Hello beautiful people. I am looking to sign up for the pro account that includ...

valkyrie_pilot•10/24/24, 6:00 PM

no, you need buisness for this.

NNelson Sousa But then the server is the one responsible for getting the image and pre-process...

valkyrie_pilot•10/24/24, 6:00 PM

Not necessarily. You could upload it and kick off a background task

Can you force a renewal of certs with letsencrypt?

Similar Threads

Similar Threads

Similar Threads