0

I want to know if it's possible to mix and match free ssl certificate from cloudflare and let's encrypt for subdomains.

E.g.

  • a.example.com and b.example.com use free ssl from cloudflare (I'm aware that cf free ssl cert is man-in-the-middle but it's okay)
  • www.example.com and c.example.com use let's encrypt
|improve this question
  • I'm curious why you could want to do this. Care to comment or expand your question? – Tim Jan 9 at 8:03
  • So I want to divide by two big groups. First group of subdomain has more potential of more traffic so maybe need paid dedicated ssl and cdn (not necessarily cf, not sure) in the future. And the other group is for experimenting, less security risk. But for initial stage , I want to use free ssl service to keep the cost down. – mhd Jan 9 at 8:46
  • I added info to my answer below about my thoughts about that. – Tim Jan 9 at 17:58
1

I think so. Here's how you can try it:

  1. Register your domain with CloudFlare, point your name servers at CloudFlare.

  2. Set up your DNS as you normally would in CloudFlare, with A records for your domains and subdomains.

  3. The domains you want CloudFlare to provide SSL for, make sure the "orange box" is turned on, on the DNS screen. This means CloudFlare will terminate the traffic.

  4. The domains you want to use Let's Encrypt for you leave as "grey box" on the DNS screen. CloudFlare acts as a simple DNS server, has nothing to do with the connection between the browser and server, and you can do whatever you like regarding SSL.

You might like to consider CloudFlare full SSL. With that setup CloudFlare terminates your traffic, then re-encrypts to send to your server using the SSL cert on your server. This gives encryption from the browser to your web server. You can use any cert on your web server for this, Let's Encrypt or self signed. To use full (strict) mode is has to be a valid public certificate, which gives you a bit more assurance CloudFlare is connecting to your server.

All of this is available on the free CloudFlare accounts.

Approach

You've updated your question to explain a bit more about the "why": that you want to use expensive certificates for high volume sites.

IMHO, the free certificates from CloudFlare or Let's Encrypt are appropriate for many sites. I would suggest considering EV Certificates if you're dealing with financial information, or you need people to be sure it's your website, otherwise my opinion (which is knowing something about security but not being an expert) is other certificates are much the same. LE / CF are both trusted by most browsers.

You still need to be careful to secure your systems and resources, as SSL isn't everything. With CF you have to be especially careful to also encrypt from CF to your server. Then if the server is important you need to harden your server, patch your software, test for vulnerabilities, etc.

|improve this answer
  • Thanks for the insight, I'll try your advice before 'accepting' the answer. Btw, I suppose to use cf full SSL feature, we need to use non-free account. CMIIW – mhd Jan 9 at 8:21
  • Everything I've described above is available on the free account tier, which is what I use. – Tim Jan 9 at 17:53
  • Do some research before springing for an EV cert - at the moment the difference in how they are displayed in various browsers is pretty small, and if they don't give the user any kind of indication of higher security, then they may not be worth paying for. – Michael Kohne Jan 9 at 18:07
  • Exactly - worth considering, but not a requirement. They used to show much more prominently in browsers, but not any more. They're probably most useful for banks and such. – Tim Jan 9 at 18:19

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.