I haven't found a clear answer to this: CloudFlare has multiple SSL configuratio... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

pmahoney on Feb 24, 2017 | parent | context | favorite | on: Cloudflare Reverse Proxies Are Dumping Uninitializ...

I haven't found a clear answer to this:

CloudFlare has multiple SSL configurations:

> Flexible SSL: There is an encrypted connection between your website visitors and Cloudflare, but not from Cloudflare to your server.

> Full SSL: Encrypts the connection between your website visitors and Cloudflare, and from Cloudflare to your server

(I'll add Full SSL mode still involves CloudFlare terminating SSL (decrypting) before re-encrypting to communicate to your server)

If I am running in Full SSL mode, is (or was) my data vulnerable to being leaked?

maknz on Feb 24, 2017 [–]

Full SSL requests still terminate at CloudFlare, and would still be vulnerable. It's just that CloudFlare's connection to your origin is also encrypted.

pmahoney on Feb 24, 2017 | [–]

Thanks. Wish they had explicitly stated that all SSL modes were affected (unless I missed it...)

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact