Let me expose my setup and problems. Maybe some of you will have ideas for me to test.
Setup
On Digital Ocean :
- I have one web server running a web site with NGINX in the front (Ruby on Rails behind, but I think this is not relevant)
- I have port 80 (http) and 443 (https) opened
- I have a valid (to my knowledge and recent checks) SSL certificate from StartSLL (will change in the near future, but also not relevant)
- I have a free Cloudflare CDN account with Strict SSL enabled.
This is a valid setup as I have no issue with my browser to access http or https. The certificate shown is the SNI certificate from Cloudflare. My site is in the list of site available.
Problems
Ok now the problems are when I try to add the site to social networks. Trying to add a photos in Tumblr or a link to Reddit using the SSL version of the site. I'm getting errors from both systems. From my understanding these are using Curl or Python script to fetch the resource and the SNI SSL is not well supported.
With the poularity of Cloudflare and most likely their free tier, I can't find much information on this subject. I browse Google and few stack exchange sites without any luck. It doesn't seems to be a problem for anybody.
Solutions
- Don't be cheap and pay 200$/month for a personal SSL on CloudFlare (I'll be glad to do this if I make enough money per month)
- Drop CoudFlare entirely and have the DigitalOcean server manage the page with HTTPS. Maybe adding a varnish or some other optimization along the way. Traffic and bandwidth could become an issue in the future.
- Drop HTTPS entirely and keep CloudFlare. This will work, but Google with give more points to site that can handle SSL and mobile traffic. I also like my privacy.
- I screw up my setup of Nginx/CloudFlare config somewhere down the line and I should pay more attention to the documentation. (I know Apache better than Nginx, but on this case, I liked some of the Nginx features that I could leverage better with Ruby on Rails)
You can tell me that I over-architect the system. At the same time, I end up with an ultra-fast site around 500ms response time with traffic distributed quickly around the world. (I have a global reach and not a local one)
Any idea are welcome.