TechPrufer
Sign inGet started

Blogs›Cloudflare›Universal SSL Deployment

Universal SSL Deployment

Universal SSL Deployment

8
posts
2011–2014

Cloudflare's Universal SSL offering has evolved to provide automated SSL certificate deployment for millions of websites. This includes prioritizing high-traffic sites, managing user expectations during provisioning delays, and providing progress tracking mechanisms. The initial rollout leveraged modern hardware with AES-NI and CLMUL instructions, and modern algorithms like ECDSA and ECDHE for faster handshakes. Session resumption techniques (session tickets and session IDs) were enhanced to wor This post marks a significant evolution by making SSL included automatically with every paid Cloudflare account at no additional cost. It introduces a "flexible" SSL mode that encrypts traffic from visitors to Cloudflare's network, protecting against common eavesdropping and attacks. This mode allows SSL to be used even in front of services where certificates cannot be installed on the origin server, simplifying the process to a one-click ease. Paid users are automatically set up with flexible or end-to-end SSL based on backend server support, with options to override or disable it.

2014

Universal SSL: How It Scales

10/2/2014

This post details the technical implementation of Universal SSL, focusing on how Cloudflare scaled its infrastructure to support millions of HTTPS websites. It highlights the use of modern hardware (Intel CPUs with AES-NI and CLMUL), modern cryptographic algorithms (ECDSA and ECDHE with P-256), session resumption techniques (session tickets and session IDs) with cross-machine sharing, and lazy loading of certificates to minimize CPU overhead and avoid performance bottlenecks.

Universal SSL: Be just a bit more patient

9/30/2014

This post details the challenges and progress of deploying Universal SSL certificates to millions of websites. It explains the prioritization strategy (most traffic first), the expected certificate mismatch errors during provisioning, and the introduction of a login alert and email notifications to track progress. It also highlights examples of working Universal SSL and mentions future plans to help resolve mixed content issues.

ECDSA: The digital signature algorithm of a better internet

3/10/2014

This post announces Cloudflare's support for custom ECDSA certificates for business customers. It explains the technical benefits of ECDSA over RSA, including smaller key sizes, faster signature generation, and reduced computational cost for TLS handshakes. The post details the performance gains observed (9.5x reduction in private key operation cost) and demonstrates the use of ECDSA on Cloudflare's own blog. It also touches upon the importance of proper random number generation for ECDSA security.

2013

CloudFlare, PRISM, and Securing SSL Ciphers

6/12/2013

This post analyzes the PRISM program and its potential implications for SSL security. It discusses the theoretical possibility of NSA cracking 1024-bit SSL keys and decrypting historical traffic, but ultimately expresses skepticism about this being the primary method for PRISM. The post highlights the importance of using stronger SSL ciphers like ECDHE and 2048-bit keys, noting that Cloudflare already defaults to these for its Universal SSL offering. It also contrasts Google's use of ECDHE with other companies' reliance on RSA-based encryption.

2012

What We Just Did to Make SSL Even Faster

12/11/2012

Introduced an automated SSL bundler that intelligently optimizes certificate chains by removing unnecessary intermediate and root certificates. Developed a directory of common intermediate certificates and a system to build the shortest, most trusted chain from uploaded certificates to browser-trusted roots. This process automates manual optimizations for performance and security, improving SSL handshake speed.

CloudFlare Works with GlobalSign to Make SSL Faster Across the Web

11/1/2012

This post details a partnership with GlobalSign to cache their OCSP and CRL requests across Cloudflare's global infrastructure. This reduces the latency of these requests from an average of 500ms to under 100ms, significantly improving SSL performance for websites using GlobalSign certificates, regardless of whether they are on Cloudflare. This also marks the first time GlobalSign's SSL checks are available over IPv6.

OCSP Stapling: How CloudFlare Just Made SSL 30% Faster

10/29/2012

Introduced OCSP Stapling network-wide to eliminate the performance tax of certificate revocation checks. This involved enabling the server to provide a signed OCSP response directly to the client during the SSL handshake, reducing the overhead by over 30% and making HTTPS connections approximately 30% faster.

2011

Easiest SSL Ever, Now Included Automatically with Every Paid Plan

11/5/2011

Introduced automatic SSL inclusion for all paid Cloudflare accounts at no additional cost. Implemented a "flexible" SSL mode to encrypt traffic between visitors and Cloudflare's network, enabling SSL for services that do not support origin server certificate installation. Removed per-subdomain SSL charges for existing paid users and simplified the process by eliminating the need to pick subdomains and wait for vetting emails.