TechPrufer
Sign inGet started

Blogs›Cloudflare›Geo Key Management

Geo Key Management

Geo Key Management

4
posts
2014–2017

Cloudflare's Geo Key Manager allows customers to control the physical distribution of their private SSL keys across Cloudflare's global data centers. This feature addresses geopolitical concerns and regulatory requirements by enabling customers to restrict key storage to specific regions (e.g., U.S. Only, E.U. Only) or to a subset of 'Highest Security' data centers. For connections to data centers without local key access, Cloudflare utilizes Keyless SSL, introducing minimal latency for the init

2017

Introducing the Cloudflare Geo Key Manager

9/26/2017

Introduced Geo Key Manager, a feature allowing customers to specify the geographic distribution of their SSL private keys across Cloudflare's data centers. This provides control over key material based on geopolitical concerns and regulatory requirements. Options include 'Everywhere' (default), 'U.S. Only', 'E.U. Only', and 'Highest Security Data Centers'. Connections to data centers without local keys use Keyless SSL, with minimal latency impact due to session resumption.

2014

One More Thing: Keyless SSL and CloudFlare's Growing Network

9/28/2014

Introduces Keyless SSL as a strategy to expand Cloudflare's global network by allowing SSL services without storing private keys in all edge data centers. This enables expansion into facilities with less stringent security requirements and addresses geopolitical concerns by allowing customers to specify key storage regions.

Keyless SSL: The Nitty Gritty Technical Details

9/19/2014

This post details the technical implementation and security considerations of Cloudflare's Keyless SSL, which allows customers to use their private SSL keys without handing them over to Cloudflare. It explains the TLS handshake process (RSA and Diffie-Hellman), the dual goals of confidentiality and authentication, and the technical details of how Keyless SSL achieves these goals by keeping the private key on the customer's origin server while enabling Cloudflare's edge to perform SSL termination.

Announcing Keyless SSL™: All the Benefits of CloudFlare Without Having to Turn Over Your Private SSL Keys

9/18/2014

Introduced Keyless SSL, a novel solution that enables SSL termination in the cloud without requiring Cloudflare to possess the customer's private SSL keys. This was achieved by splitting session signing from the rest of the SSL handshake, allowing an agent on the customer's infrastructure to perform the private key operations while the remote Cloudflare server handles the connection. This addressed the security concerns of financial institutions regarding key compromise and enabled them to leverage cloud-based scalability for SSL termination.