2

Let me expose my setup and problems. Maybe some of you will have ideas for me to test.

Setup

On Digital Ocean :

  • I have one web server running a web site with NGINX in the front (Ruby on Rails behind, but I think this is not relevant)
  • I have port 80 (http) and 443 (https) opened
  • I have a valid (to my knowledge and recent checks) SSL certificate from StartSLL (will change in the near future, but also not relevant)
  • I have a free Cloudflare CDN account with Strict SSL enabled.

This is a valid setup as I have no issue with my browser to access http or https. The certificate shown is the SNI certificate from Cloudflare. My site is in the list of site available.

Problems

Ok now the problems are when I try to add the site to social networks. Trying to add a photos in Tumblr or a link to Reddit using the SSL version of the site. I'm getting errors from both systems. From my understanding these are using Curl or Python script to fetch the resource and the SNI SSL is not well supported.

With the poularity of Cloudflare and most likely their free tier, I can't find much information on this subject. I browse Google and few stack exchange sites without any luck. It doesn't seems to be a problem for anybody.

Solutions

  • Don't be cheap and pay 200$/month for a personal SSL on CloudFlare (I'll be glad to do this if I make enough money per month)
  • Drop CoudFlare entirely and have the DigitalOcean server manage the page with HTTPS. Maybe adding a varnish or some other optimization along the way. Traffic and bandwidth could become an issue in the future.
  • Drop HTTPS entirely and keep CloudFlare. This will work, but Google with give more points to site that can handle SSL and mobile traffic. I also like my privacy.
  • I screw up my setup of Nginx/CloudFlare config somewhere down the line and I should pay more attention to the documentation. (I know Apache better than Nginx, but on this case, I liked some of the Nginx features that I could leverage better with Ruby on Rails)

You can tell me that I over-architect the system. At the same time, I end up with an ultra-fast site around 500ms response time with traffic distributed quickly around the world. (I have a global reach and not a local one)

Any idea are welcome.

4
  • Just to jig a bid the question, because so far no answer on this. When I did a test on some website tester I end up with this remark: The token is not delivered by STS. Is it important or not I don't know.
    – Hugues
    Sep 29, 2015 at 17:30
  • Pretty much everything has supported SNI for many years. If you're having an error with these services, perhaps you should be specific about what it is, and try to solve it. Oct 2, 2015 at 16:15
  • @MichaelHampton, Browser are working fine, I can see people ending on the site with many browsers. The social network like tumblr and reddit are using their own tool to fetch information from my site. I have no visibility on the error beside Error. I wish to investigate further more, but it is vey thin to work on.
    – Hugues
    Oct 6, 2015 at 17:31
  • I can confirm this is not only my site. You can try to add link to reddit (trendwealth.org) and the title won't be found. Put in HTTP and the title show up. Add a picture in tumblr (trendwealth.org/files/2014/04/5534502416799316873803.jpg), add a comment, try to submit, you got an error. Set to HTTP, you're crusing.
    – Hugues
    Oct 6, 2015 at 18:11

1 Answer 1

1

If it is indeed SNI that is the issue, CloudFlare's Pro Plan could most likely fix it as that has support for more browsers and is $5 (as opposed to the $200 plan).

For testing your SSL setup and the browsers which it should work in, you could try SSL Labs - They provide an online tool which is pretty comprehensive and free.

As for your "The token is not delivered by STS" issue, I'm going to take a guess that it's unrelated, based on a few results that google turns up.

For people who got here from google: If you've only recently enabled CloudFlare for your domain and are having SSL issues, make sure that you've waited long enough for your DNS changes to propagate internationally (48 hours should do it, max) and ensure that on the "Crypto" page of your CloudFlare dashboard it says "Certificate Active".

4
  • CloudFlare Pro Plan has a SSL certificate issued by them same as free plan, so this is still the same issue. On the SSL Lab, I got all A for IPV4 and IPV6. For the wait time you are correct. 48 hours and certificate active on your cloudflare crypto dashboard.
    – Hugues
    Oct 6, 2015 at 17:43
  • @Hugues The certificates do differ between Free and Pro plans, Here's two domains in my control, tested with SSL Labs: Site on a Free Plan vs Site on a Pro Plan. The Free plan uses SNI, but with a stronger certificate. The Pro plan doesn't use SNI, has a weaker certificate, but supports more browsers and platforms because of this. See also: CloudFlare SSL FAQ
    – danw3108
    Oct 8, 2015 at 13:44
  • Ok I just tried to post one picture of your site on Tumblr. It works. The difference I didn't catch from Cloudflare is that Pro version is that the SSL certificate is NOT the same technique as the free. Now the Pro version is 20$ per month. I see all the advantages, but this is still steep cost.
    – Hugues
    Oct 15, 2015 at 18:31
  • 1
    To complete the discussion here the SNI is the problem and this look like it can't really be solved from our admin hands and this is a Cloudflare things. At the same time, I'm not thrilled to be presented a feature and not really be able to us it despite the warning. I guess that is what you have for free, but in that case a pretty much useless free stuff.
    – Hugues
    Oct 15, 2015 at 18:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .