Introducing Strict SSL: Protecting Against a On-Path Attack on Origin Traffic
Feb 14, 2014Nick Sullivan
Summary
Introduced 'Full SSL (Strict)' mode, which adds origin server certificate validation to the existing Full SSL option. This new mode prevents on-path attacks by ensuring that Cloudflare validates the certificate chain presented by the web server against its own list of trusted certificate authorities. Changes were upstreamed to nginx to enable origin certificate validation and support SNI for multiple domains behind the same IP over TLS.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack