2

How are so many sites OK with using cloudflare when they are basically a MITM?

posted
by
Avatar
spottyPotty@alien.topB
in
Avatar
main@selfhosted.forum
87 comments
hidereport

Regardless of whether or not you provide your own SSL certificates, cloudflare still uses their own between their servers and client browsers. So any SSL encrypted traffic is unencrypted at their end before being re-encrypted with your certificate. How can such an entity be trusted?

Sort:
HotTopControversialNewOld
You are viewing a single thread.
View all comments View context
Avatar
sjsathanas@alien.topB
0 points

CF provides different encryption modes. So if it’s “Full” you’ll need a valid SSL cert on your server, which CF will use end-to-end. If it’s “Flexible” (IIRC), then you don’t need a cert on your server, in which case CF will use their own cert for encryption.

permalink
report
parent
reply

Self-Hosted Main

!main@selfhosted.forum

Create post

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.

For Example

  • Service: Dropbox - Alternative: Nextcloud
  • Service: Google Reader - Alternative: Tiny Tiny RSS
  • Service: Blogger - Alternative: WordPress

We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.

Useful Lists

Community stats

  • 17

    Monthly active users

  • 1.8K

    Posts

  • 11K

    Comments

Community moderators