Last September, CloudFlare unveiled Universal SSL, enabling HTTPS support for all sites by default. All sites using CloudFlare now support strong cryptography from the browser to CloudFlare’s servers. One of the most popular requests for Universal SSL was to make it easier to encrypt the other half of the connection: from CloudFlare to the origin server.
Until today, encryption from CloudFlare to the origin required the purchase of a trusted certificate from a third party. The certificate purchasing process can be tedious and sometimes costly. To remedy this, CloudFlare has created a new Origin CA service in which we provide free limited-function certificates to customer origin servers.
Today we are excited to announce the public beta of this service, providing full encryption of all data from the browser to the origin, for free.
Encrypted all the way
CloudFlare offers three modes for HTTPS: Flexible, Full and Strict. In Flexible mode, traffic from browsers to CloudFlare is encrypted, but traffic from CloudFlare to a site's origin server is not. In Full and Strict modes, traffic between CloudFlare and the origin server is encrypted. Strict mode adds validation of the origin server’s certificate. We strongly encourage customers to select Strict mode for their websites to ensure their visitors get the strongest data security possible.
As we previously discussed, sites on CloudFlare’s Free plan default to Flexible SSL mode. To take advantage of our Strict SSL mode it’s necessary to install a certificate on the origin server, which until now required them to buy one from a third party. Now customers can get that certificate directly from CloudFlare, for free.
This certificate is only used to protect the traffic between the origin server and CloudFlare; it is never presented to browsers. For now you should only use it behind orange-clouded sites on CloudFlare.
If you are a CloudFlare customer and want to sign up for the beta, just send an email to origin-ca-beta@cloudflare.com with the following:
A certificate signing request (CSR)
The domain name of the orange-clouded zone you want to install the certificate on
The first ten brave beta customers will get a shiny new certificate to install on their web server. Note: do not send your private key to CloudFlare, only the CSR is needed.
Update: The beta is full! Thanks to those who are participating.
CloudFlare’s Origin Certificate Authority
In order to grant certificates to customer origins, CloudFlare had to create its own Certificate Authority. This consists of a set of processes and systems to validate certificate requests and create new certificates. For the Origin CA, CloudFlare created a private key and certificate for the specific purpose of signing certificates for origin servers.
Software
The certificate authority software we use is CFSSL, our open source PKI toolkit written in Go. It allows us to validate CSRs and use them to create new certificates for sites. These certificates are signed with our certificate authority private key, and validated when CloudFlare connects to the origin in Strict SSL mode.
In collaboration with other members of the industry (such as Richard Barnes from the Let's Encrypt project), we have updated CFSSL with several new features that help make it a viable certificate authority tool. These include PKCS#11 support, which makes it possible for CFSSL to use a Hardware Security Module (HSM) to store private keys and OCSP support, which lets CFSSL answer questions about the revocation status of a certificate.
Validation
CAs are supposed to only give certificates to sites that own the domain(s) listed in the certificate. Domain validation is usually done in one of three ways:
Putting a challenge in the DNS zone
Putting a challenge into a meta-tag of an HTML page hosted on the domain
Sending an email challenge to the domain registrant from the WhoIs DB
Since CloudFlare is both a content delivery network and a DNS provider, both DNS and HTML validation can be done by CloudFlare on behalf of the site. If your site is on CloudFlare and orange-clouded, we will give you a certificate for your site.
Public trust
The CloudFlare Origin CA is currently not trusted by browsers, so these certificates should not be used on sites that are not behind CloudFlare. To issue certificates that are trusted by browsers, we would have to convince a publicly trusted certificate authority to cross-sign our CA certificate. This is not necessary in this case since it is CloudFlare that determines which certificates we trusted and the Origin CA is on our list.
Bonus: How to create Certificate Signing Requests
The certificate signing request (CSR) is the standard mechanism for obtaining a certificate from a certificate authority. It contains a public key, some metadata such as which domain it is for and is digitally signed by a private key. It lets CloudFlare know that you own the private key.
Creating a CSR and private key with CFSSL
CFSSL is not only a tool that can be used for running a CA, but it can be used to create CSRs too. Following these instructions will get you a private key and a CSR to submit to a certificate authority.
1) Install Go:
https://golang.org/doc/install
2) Install CFSSL
$ go get github.com/cloudflare/cfssl/cmd/...3) Create a CSR template
Use the following template for csr.json and replace “mysite.com” with your site’s domain name and names with your company's information.
csr.json:
{
"key": {
"algo": "rsa",
"size": 2048
},
"hosts": [
“mysite.com"
],
"CN": "mysite.com",
"names": [
{
"C": "US",
"L": "San Francisco",
"ST": "California",
"O": "My Company, Inc.",
"OU": "My Company’s IT Department"
}
]
}4) Create the certificate
$ cfssl genkey csr.json | cfssljson -bare siteThis creates two files:
site.csr: your CSRsite-key.pem: your private key
Other resources
If CFSSL is not working for you, here are some more resources for creating CSRs:
In the future we plan on releasing tools to make certificate generation even easier and more automatic.