All posts by Dina Kozlov

Connect any React application to an MCP server in three lines of code

Post Syndicated from Dina Kozlov original https://blog.cloudflare.com/connect-any-react-application-to-an-mcp-server-in-three-lines-of-code/

You can deploy a remote Model Context Protocol (MCP) server on Cloudflare in just one-click. Don’t believe us? Click the button below.

This will get you started with a remote MCP server that supports the latest MCP standards and is the reason why thousands of remote MCP servers have been deployed on Cloudflare, including ones from companies like Atlassian, Linear, PayPal, and more

But deploying servers is only half of the equation — we also wanted to make it just as easy to build and deploy remote MCP clients that can connect to these servers to enable new AI-powered service integrations. That’s why we built use-mcp, a React library for connecting to remote MCP servers, and we’re excited to contribute it to the MCP ecosystem to enable more developers to build remote MCP clients.

Today, we’re open-sourcing two tools that make it easy to build and deploy MCP clients:

  1. use-mcp — A React library that connects to any remote MCP server in just 3 lines of code, with transport, authentication, and session management automatically handled. We’re excited to contribute this library to the MCP ecosystem to enable more developers to build remote MCP clients. 

  2. The AI Playground — Cloudflare’s AI chat interface platform that uses a number of LLM models to interact with remote MCP servers, with support for the latest MCP standard, which you can now deploy yourself. 

Whether you’re building an AI-powered chat bot, a support agent, or an internal company interface, you can leverage these tools to connect your AI agents and applications to external services via MCP. 

Ready to get started? Click on the button below to deploy your own instance of Cloudflare’s AI Playground to see it in action.

use-mcp: a React library for building remote MCP clients

use-mcp is a React library that abstracts away all the complexity of building MCP clients. Add the useMCP() hook into any React application to connect to remote MCP servers that users can interact with. 

Here’s all the code you need to add to connect to a remote MCP server: 

mport { useMcp } from 'use-mcp/react'
function MyComponent() {
  const { state, tools, callTool } = useMcp({
    url: 'https://mcp-server.example.com'
  })
  return <div>Your actual UI code</div>
}

Just specify the URL, and you’re instantly connected. 

Behind the scenes, use-mcp handles the transport protocols (both Streamable HTTP and Server-Sent Events), authentication flows, and session management. It also includes a number of features to help you build reliable, scalable, and production-ready MCP clients. 

Connection management 

Network reliability shouldn’t impact user experience. use-mcp manages connection retries and reconnections with a backoff schedule to ensure your client can recover the connection during a network issue and continue where it left off. The hook exposes real-time connection states (“connecting”, “ready”, “failed”), allowing you to build responsive UIs that keep users informed without requiring you to write any custom connection handling logic. 

const { state } = useMcp({ url: 'https://mcp-server.example.com' })

if (state === 'connecting') {
  return <div>Establishing connection...</div>
}
if (state === 'ready') {
  return <div>Connected and ready!</div>
}
if (state === 'failed') {
  return <div>Connection failed</div>
}

Authentication & authorization

Many MCP servers require some form of authentication in order to make tool calls. use-mcp supports OAuth 2.1 and handles the entire OAuth flow.  It redirects users to the login page, allows them to grant access, securely stores the access token returned by the OAuth provider, and uses it for all subsequent requests to the server. The library also provides methods for users to revoke access and clear stored credentials. This gives you a complete authentication system that allows you to securely connect to remote MCP servers, without writing any of the logic. 

const { clearStorage } = useMcp({ url: 'https://mcp-server.example.com' })

// Revoke access and clear stored credentials
const handleLogout = () => {
  clearStorage() // Removes all stored tokens, client info, and auth state
}

Dynamic tool discovery

When you connect to an MCP server, use-mcp fetches the tools it exposes. If the server adds new capabilities, your app will see them without any code changes. Each tool provides type-safe metadata about its required inputs and functionality, so your client can automatically validate user input and make the right tool calls.

Debugging & monitoring capabilities

To help you troubleshoot MCP integrations, use-mcp exposes a log array containing structured messages at debug, info, warn, and error levels, with timestamps for each one. You can enable detailed logging with the debug option to track tool calls, authentication flows, connection state changes, and errors. This real-time visibility makes it easier to diagnose issues during development and production. 

Future-proofed & backwards compatible

MCP is evolving rapidly, with recent updates to transport mechanisms and upcoming changes to authorization. use-mcp supports both Server-Sent Events (SSE) and the newer Streamable HTTP transport, automatically detecting and upgrading to newer protocols, when supported by the MCP server. 

As the MCP specification continues to evolve, we’ll keep the library updated with the latest standards, while maintaining backwards compatibility. We are also excited to contribute use-mcp to the MCP project, so it can grow with help from the wider community.

MCP Inspector, built with use-mcp

In use-mcp’s examples directory, you’ll see a minimal MCP Inspector that was built with the use-mcp hook. . Enter any MCP server URL to test connections, see available tools, and monitor interactions through the debug logs. It’s a great starting point for building your own MCP clients or something you can use to debug connections to your MCP server. 


Open-sourcing the AI Playground 

We initially built the AI Playground to give users a chat interface for testing different AI models supported by Workers AI. We then added MCP support, so it could be used as a remote MCP client to connect to and test MCP servers. Today, we’re open-sourcing the playground, giving you the complete chat interface with the MCP client built in, so you can deploy it yourself and customize it to fit your needs. 

The playground comes with built-in support for the latest MCP standards, including both Streamable HTTP and Server-Sent Events transport methods, OAuth authentication flows that allow users to sign-in and grant permissions, as well as support for bearer token authentication for direct MCP server connections.


How the AI Playground works

The AI Playground is built on Workers AI, giving you access to a full catalog of large language models (LLMs) running on Cloudflare’s network, combined with the Agents SDK and use-mcp library for MCP server connections.

The AI Playground uses the use-mcp library to manage connections to remote MCP servers. When the playground starts up, it initializes the MCP connection system with const{tools: mcpTools} = useMcp(), which provides access to all tools from connected servers. At first, this list is empty because it’s not connected to any MCP servers, but once a connection to a remote MCP server is established, the tools are automatically discovered and populated into the list. 

Once connected, the playground immediately has access to any tools that the MCP server exposes. The use-mcp library handles all the protocol communication and tool discovery, and maintains the connection state. If the MCP server requires authentication, the playground handles OAuth flows through a dedicated callback page that uses onMcpAuthorization from use-mcp to complete the authentication process.

When a user sends a chat message, the playground takes the mcpTools from the use-mcp hook and passes them directly to Workers AI, enabling the model to understand what capabilities are available and invoke them as needed. 

const stream = useChat({
  api: "/api/inference",
  body: {
    model: params.model,
    tools: mcpTools, // Tools from connected MCP servers
    max_tokens: params.max_tokens,
    system_message: params.system_message,
  },
})

Debugging and monitoring

To monitor and debug connections to MCP servers, we’ve added a Debug Log interface to the playground. This displays real-time information about the MCP server connections, including connection status, authentication state, and any connection errors. 

During the chat interactions, the debug interface will show the raw message exchanged between the playground and the MCP server, including the tool invocation and its result. This allows you to monitor the JSON payload being sent to the MCP server, the raw response returned, and track whether the tool call succeeded or failed. This is especially helpful for anyone building remote MCP servers, as it allows you to see how your tools are behaving when integrated with different language models. 

Contributing to the MCP ecosystem

One of the reasons why MCP has evolved so quickly is that it’s an open source project, powered by the community. We’re excited to contribute the use-mcp library to the MCP ecosystem to enable more developers to build remote MCP clients. 

If you’re looking for examples of MCP clients or MCP servers to get started with, check out the Cloudflare AI GitHub repository for working examples you can deploy and modify. This includes the complete AI Playground source code, a number of remote MCP servers that use different authentication & authorization providers, and the MCP Inspector

We’re also building the Cloudflare MCP servers in public and welcome contributions to help make them better. 

Whether you’re building your first MCP server, integrating MCP into an existing application, or contributing to the broader ecosystem, we’d love to hear from you. If you have any questions, feedback, or ideas for collaboration, you can reach us via email at [email protected].


MCP Demo Day: How 10 leading AI companies built MCP servers on Cloudflare

Post Syndicated from Dina Kozlov original https://blog.cloudflare.com/mcp-demo-day/

Today, we’re excited to collaborate with Anthropic, Asana, Atlassian, Block, Intercom, Linear, PayPal, Sentry, Stripe, and Webflow to bring a whole new set of remote MCP servers, all built on Cloudflare, to enable Claude users to manage projects, generate invoices, query databases, and even deploy full stack applications — without ever leaving the chat interface. 

Since Anthropic’s introduction of the Model Context Protocol (MCP) in November, there’s been more and more excitement about it, and it seems like a new MCP server is being released nearly every day. And for good reason!  MCP has been the missing piece to make AI agents a reality, and helped define how AI agents interact with tools to take actions and get additional context.

But to date, end-users have had to install MCP servers on their local machine to use them. Today, with Anthropic’s announcement of Integrations, you can access an MCP server the same way you would a website: type a URL and go.


At Cloudflare, we’ve been focused on building out the tooling that simplifies the development of remote MCP servers, so that our customers’ engineering teams can focus their time on building out the MCP tools for their application, rather than managing the complexities of the protocol. And if you’re wondering just how easy is it to deploy a remote MCP server on Cloudflare, we’re happy to tell you that it only takes one click to get an MCP server — pre-built with support for the latest MCP standards — deployed. 

But you don’t have to take our word for it, see it for yourself! Industry leaders are taking advantage of the ease of use to deliver new AI-powered experiences to their users by building their MCP servers on Cloudflare and now, you can do the same — just click “Deploy to Cloudflare” to get started. 

Keep reading to learn more about the new capabilities that these companies are unlocking for their users and how they were able to deliver them. Or, see it in action by joining us for Demo Day on May 1 (today) at 10:00 AM PST. 

We’re also making Cloudflare’s remote MCP servers available to customers today and sharing what we learned from building them out. 

MCP: Powering the next generation of applications

It wasn’t always the expectation that every service, whether a store, real estate agent, or service would have a website. But as more people gained access to an Internet connection, that quickly became the case.

We’re in the midst of a similar transition now to every web user having access to AI tools, turning to them for many tasks. If you’re a developer, it’s likely the case that the first place you turn when you go to write code now is to a tool like Claude. It seems reasonable then, that if Claude helped you write the code, it would also help you deploy it.

Or if you’re not a developer, if Claude helped you come up with a recipe, that it would also help you order the required groceries. 

With remote MCP, all of these scenarios are now possible. And just like the first businesses built on the web had a first mover advantage, the first businesses to be built in an MCP-forward way are likely to reap the benefits. 

The faster a user can experience the value of your product, the more likely they will be to succeed, upgrade, and continue to use your product. By connecting services to agents through MCP, users can simply ask for what they need and the agent will handle the rest, getting them to that “aha” moment faster. 

Making your service AI-first with MCP

Businesses that adopt MCP will quickly see the impact: 

Lower the barrier to entry

Not every user has the time to learn your dashboard or read through documentation to understand your product. With MCP, they don’t need to. They just describe what they want, and the agent figures out the rest. 

Create personalized experiences

MCP can keep track of a user’s requests and interactions, so future tool calls can be adapted to their usage patterns and preferences. This makes it easy to deliver more personalized, relevant experiences based on how each person actually uses your product.

Drive upgrades naturally

Rather than relying on feature comparison tables, the AI agent can explain how a higher-tier plan helps a specific user accomplish their goals. 

Ship new features and integrations

You don’t need to build every integration or experience in-house. By exposing your tools via MCP, you let users connect your product to the rest of their stack. Agents can combine tools across providers, enabling integrations without requiring you to support every third-party service directly.

Why build MCP on Cloudflare? 

Since the launch of MCP, we’ve shared how we’re making it easy for developers to build and deploy remote MCP servers — from abstracting away protocol complexity to handling auth and transport, to supporting fully stateful MCP servers (by default) that “sleep” when they’re not used to minimize idle costs.


We’re continuing to ship updates regularly — adding support for the latest changes to the MCP standard and making it even easier to get your server to production:

But rather than telling you, we thought it would be better to show you what our customers have built and why they chose Cloudflare for their MCP deployment. 

Remote MCP servers you can connect to today

Asana

Today, work lives across many different apps and services. By investing in MCP, Asana can meet users where they are, enabling agent-driven interoperability across tools and workflows. Users can interact with the Asana Work Graph using natural language to get project updates, search for tasks, manage projects, send comments, and update deadlines from an MCP client.

Users will be able to orchestrate and integrate different pieces of work seamlessly — for example, turning a project plan or meeting notes from another app into a fully assigned set of tasks in Asana, or pulling Asana tasks directly into an MCP-enabled IDE for implementation. This flexibility makes managing work across systems easier, faster, and more natural than ever before.

To accelerate the launch of our first-party MCP server, Asana built on Cloudflare’s tooling, taking advantage of the foundational infrastructure to move quickly and reliably in this fast-evolving space.

“At Asana, we’ve always focused on helping teams coordinate work effortlessly. MCP connects our Work Graph directly to AI tools like Claude.ai, enabling AI to become a true teammate in work management. Our integration transforms natural language into structured work – creating projects from meeting notes or pulling updates into AI. Building on Cloudflare’s infrastructure allowed us to deploy quickly, handling authentication and scaling while we focused on creating the best experience for our users.” – Prashant Pandey, Chief Technology Officer, Asana

Learn more about Asana’s MCP server here

Atlassian

Jira and Confluence Cloud customers can now securely interact with their data directly from Anthropic’s Claude app via the Atlassian Remote MCP Server in beta. Hosted on Cloudflare infrastructure, users can summarize work, create issues or pages, and perform multi-step actions, all while keeping data secure and within permissioned boundaries.

Users can access information from Jira and Confluence wherever they use Claude to:

  • Summarize Jira work items or Confluence pages

  • Create Jira work items or Confluence pages directly from Claude

  • Get the model to take multiple actions in one go, like creating issues or pages in bulk

  • Enrich Jira work items with context from many different sources to which Claude has access

  • And so much more!

“AI is not one-size-fits-all and we believe that it needs to be embedded within a team’s jobs to be done. That’s why we’re so excited to invest in MCP and meet teams in more places where they already work. Hosting on Cloudflare infrastructure means we can bring this powerful integration to our customers faster and empower them to do more than ever with Jira and Confluence, all while keeping their enterprise data secure. Cloudflare provided everything from OAuth to out-of-the-box remote MCP support so we could quickly build, secure, and scale a fully operational setup.” — Taroon Mandhana, Head of Product Engineering, Atlassian

Learn more about Atlassian’s MCP server here

Intercom

At Intercom, the transformative power of AI is becoming increasingly clear. Fin, Intercom’s AI Agent, is now autonomously resolving over 50% of customer support conversations for leading companies such as Anthropic. With MCP, connecting AI to internal tools and systems is easier than ever, enabling greater business value.

Customer conversations, for instance, offer valuable insights into how products are being used and the experiences customers are having. However, this data is often locked within the support platform. The Intercom MCP server unlocks this rich source of customer data, making it accessible to anyone in the organization using AI tools. Engineers, for example, can leverage conversation history and user data from Intercom in tools like Cursor or Claude Code to diagnose and resolve issues more efficiently.

“The momentum behind MCP is exciting. It’s making it easier and easier to connect assistants like Claude.ai and agents like Fin to your systems and get real work done. Cloudflare’s toolkit is accelerating that movement even faster. Their clear documentation, purpose-built tools, and developer-first platform helped Intercom go from concept to production in under a day, making the Intercom MCP server launch effortless. We’ll be encouraging our customers to leverage Cloudflare to build and deploy their own MCP servers to securely and reliably connect their internal systems to Fin and other clients.” — Jordan Neill, SVP Engineering, Intercom

Linear

The Linear MCP server allows users to bring the context of their issues and product development process directly into AI assistants when it’s needed. Whether that is refining a product spec in Claude, collaborating on fixing a bug with Cursor, or creating issues on the fly from an email. 

“We’re building on Cloudflare to take advantage of their frameworks in this fast-moving space and flexible, fast, compute at the edge. With MCP, we’re bringing Linear’s issue tracking and product development workflows directly into their AI tools of choice, eliminating context switching for teams. Our goal is simple: let developers and product teams access their work where they already are—whether refining specs in Claude, debugging in Cursor, or creating issues from conversations. This seamless integration helps our customers stay in flow and focused on building great products” — Tom Moor, Head of US Engineering, Linear

Learn more about Linear’s MCP server here

PayPal

“MCPs represent a new paradigm for software development. With PayPal’s remote MCP server on Cloudflare, now developers can delegate to an agent with natural language to seamlessly integrate with PayPal’s portfolio of commerce capabilities. Whether it’s managing inventory, processing payments, tracking shipping, handling refunds, AI agents via MCP can tap into these capabilities to autonomously execute and optimize commerce workflows. This is a revolutionary development for commerce, and the best part is, developers can begin integrating with our MCP server on Cloudflare today.” – Prakhar Mehrotra, SVP of Artificial Intelligence, PayPal

Learn more about PayPal’s MCP server here

Sentry

With the Sentry MCP server, developers are able to query Sentry’s context right from their IDE, or an assistant like Claude, to get errors and issue information across projects or even for individual files.

Developers can also use the MCP to create projects, capture setup information, and query project and organization information – and use the information to set up their applications for Sentry. As we continue to build out the MCP further, we’ll allow teams to bring in root cause analysis and solution information from Seer, our Agent, and also look at simplifying instrumentation for sentry functionality like traces, and exception handling. 

Hosting this on Cloudflare and using Remote MCP, we were able to sidestep a number of the complications of trying to run locally, like scaling or authentication. Remote MCP lets us leverage Sentry’s own OAuth configuration directly. Durable Object support also lets us maintain state within the MCP, which is important when you’re not running locally. 

“Sentry’s commitment has always been to the developer, and making it easier to keep production software running stable, and that’s going to be even more true in the AI era. Developers are utilizing tools like MCP to integrate their stack with AI models and data sources. We chose to build our MCP on Cloudflare because we share a vision of making it easier for developers to ship software, and are both invested in ensuring teams can build and safely run the next generation of AI agents. Debugging the complex interactions arising from these integrations is increasingly vital, and Sentry provides the essential visibility needed to rapidly diagnose and resolve issues. MCP integrates this crucial Sentry context directly into the developer workflow, empowering teams to consistently build and deploy reliable applications.” — David Cramer, CPO and Co-Founder, Sentry

Learn more about Sentry’s MCP server here

Block 

Square’s APIs are a comprehensive set of tools that help sellers take payments, create and track orders, manage inventory, organize customers, and more. Now, with a dedicated Square MCP server, sellers can enlist the help of an AI agent to build their business on Square’s entire suite of API resources and endpoints. By integrating with AI agents like Claude and codename goose, sellers can craft sophisticated, customized use cases that fully utilize Square’s capabilities, at a lower technical barrier.

Learn more about Block’s MCP server here

Stripe

“MCP is emerging as a new AI interface. In the near-future, MCP may become the default way, or in some cases the only way, people, businesses, and code discover and interact with services. With Stripe’s agent toolkit and Cloudflare’s Agent SDK, developers can now monetize their MCPs with just a few lines of code.” — Jeff Weinstein, Product Lead at Stripe

Webflow

The Webflow MCP server supports CMS management, auditing and improving SEO, content localization, site publishing, and more. This enables users to manage and improve their site directly from their AI agent. 

“We see MCP as a new way to interact with Webflow that aligns well with our mission of bringing development superpowers to everyone. MCP is not just a different surface over our APIs, instead we’re thinking of it in terms of the actions it supports: publish a website, create a CMS collection, update content, and more. MCP lets us expose those actions in a way that’s discoverable, secure, and deeply contextual. It opens the door to new workflows where AI and humans can work side-by-side, without needing to cobble together solutions or handle low-level API details. Cloudflare supports this aim by offering the reliability, performance, and developer tooling we need to build modern web infrastructure. Their support for remote MCP servers is mature and well-integrated, and their approach to authentication and durability aligns with how we think about the scale and security of these offerings.” — Utkarsh Sengar, VP of Engineering, Webflow

Learn more about Webflow’s MCP server here

Start building today 

If you’re looking to build a remote MCP server for your service, get started with our documentation, watch the tutorial below, or use the button below to get a starter remote MCP server deployed to production. Once the remote MCP server is deployed, it can be used from Claude, Cloudflare’s AI playground, or any remote MCP client. 

In addition, we launched a new YouTube video walking you through building MCP servers, using two of our MCP templates.

If you have any questions or feedback for us, you can reach us via email at [email protected].


Hi Claude, build an MCP server on Cloudflare Workers

Post Syndicated from Dina Kozlov original https://blog.cloudflare.com/model-context-protocol/

In late November 2024, Anthropic announced a new way to interact with AI, called Model Context Protocol (MCP). Today, we’re excited to show you how to use MCP in combination with Cloudflare to extend the capabilities of Claude to build applications, generate images and more. You’ll learn how to build an MCP server on Cloudflare to make any service accessible through an AI assistant like Claude with just a few lines of code using Cloudflare Workers. 

A quick primer on the Model Context Protocol (MCP)

MCP is an open standard that provides a universal way for LLMs to interact with services and applications. As the introduction on the MCP website puts it,

“Think of MCP like a USB-C port for AI applications. Just as USB-C provides a standardized way to connect your devices to various peripherals and accessories, MCP provides a standardized way to connect AI models to different data sources and tools.” 

From an architectural perspective, MCP is comprised of several components:

  • MCP hosts: Programs or tools (like Claude) where AI models operate and interact with different services

  • MCP clients: Client within an AI assistant that initiates requests and communicates with MCP servers to perform tasks or access resources

  • MCP servers: Lightweight programs that each expose the capabilities of a service

  • Local data sources: Files, databases, and services on your computer that MCP servers can securely access

  • Remote services: External Internet-connected systems that MCP servers can connect to through APIs

Imagine you ask Claude to send a message in a Slack channel. Before Claude can do this, Slack must communicate which tools are available. It does this by defining tools — such as “list channels”, “post messages”, and “reply to thread” — in the MCP server. Once the MCP client knows what tools it should invoke, it can complete the task. All you have to do is tell it what you need, and it will get it done. 

Allowing AI to not just generate, but deploy applications for you

What makes MCP so powerful? As a quick example, by combining it with a platform like Cloudflare Workers, it allows Claude users to deploy a Cloudflare Worker in just one sentence, resulting in a site like this



But that’s just one example. Today, we’re excited to show you how you can build and deploy your own MCP server to allow your users to interact with your application directly from an LLM like Claude, and how you can do that just by writing a Cloudflare Worker.

Simplifying your MCP Server deployment with workers-mcp

The new workers-mcp tooling handles the translation between your code and the MCP standard, so that you don’t have to do the maintenance work to get it set up.

Once you create your Worker and install the MCP tooling, you’ll get a worker-mcp template set up for you. This boilerplate removes the overhead of configuring the MCP server yourself:

import { WorkerEntrypoint } from 'cloudflare:workers'
import { ProxyToSelf } from 'workers-mcp'
export default class MyWorker extends WorkerEntrypoint<Env> {
  /**
   * A warm, friendly greeting from your new Workers MCP server.
   * @param name {string} the name of the person we are greeting.
   * @return {string} the contents of our greeting.
   */
  sayHello(name: string) {
    return `Hello from an MCP Worker, ${name}!`
  }
  /**
   * @ignore
   **/
  async fetch(request: Request): Promise<Response> {
    return new ProxyToSelf(this).fetch(request)
  }
}

Let’s unpack what’s happening here. This provides a direct link to MCP. The ProxyToSelf logic ensures that your Worker is wired up to respond as an MCP server, without any complex routing or schema definitions. 

It also provides tool definition with JSDoc. You’ll notice that the `sayHello` method is annotated with JSDoc comments describing what it does, what arguments it takes, and what it returns. These comments aren’t just for human readers, but they’re also used to generate documentation that your AI assistant (Claude) can understand. 

Adding image generation to Claude

When you build an MCP server using Workers, adding custom functionality to an LLM is easy. Instead of setting up the server infrastructure, defining request schemas, all you have to do is write the code. Above, all we did was generate a “hello world”, but now let’s power up Claude to generate an image, using Workers AI:

import { WorkerEntrypoint } from 'cloudflare:workers'
import { ProxyToSelf } from 'workers-mcp'

export default class ClaudeImagegen extends WorkerEntrypoint<Env> {
 /**
   * Generate an image using the flux-1-schnell model.
   * @param prompt {string} A text description of the image you want to generate.
   * @param steps {number} The number of diffusion steps; higher values can improve quality but take longer.
   */
  async generateImage(prompt: string, steps: number): Promise<string> {
    const response = await this.env.AI.run('@cf/black-forest-labs/flux-1-schnell', {
      prompt,
      steps,
    });
        // Convert from base64 string
        const binaryString = atob(response.image);
        // Create byte representation
        const img = Uint8Array.from(binaryString, (m) => m.codePointAt(0)!);
        
        return new Response(img, {
          headers: {
            'Content-Type': 'image/jpeg',
          },
        });
      }
  /**
   * @ignore
   */
  async fetch(request: Request): Promise<Response> {
    return new ProxyToSelf(this).fetch(request)
  }
}

Once you update the code and redeploy the Worker, Claude will now be able to use the new image generation tool. All you have to say is: “Hey! Can you create an image of a lava lamp wall that lives in San Francisco?”


If you’re looking for some inspiration, here are a few examples of what you can build with MCP and Workers: 

  • Let Claude send follow-up emails on your behalf using Email Routing

  • Ask Claude to capture and share website previews via Browser Automation

  • Store and manage sessions, user data, or other persistent information with Durable Objects

  • Query and update data from your D1 database 

  • …or call any of your existing Workers directly!

Why use Workers for building your MCP server?

To build out an MCP server without access to Cloudflare’s tooling, you would have to: initialize an instance of the server, define your APIs by creating explicit schemas for every interaction, handle request routing, ensure that the responses are formatted correctly, write handlers for every action, configure how the server will communicate, and more… As shown above, we do all of this for you.

For reference, an implementation may look something like this:

import { Server } from "@modelcontextprotocol/sdk/server/index.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

const server = new Server({ name: "example-server", version: "1.0.0" }, {
  capabilities: { resources: {} }
});

server.setRequestHandler(ListResourcesRequestSchema, async () => {
  return {
    resources: [{ uri: "file:///example.txt", name: "Example Resource" }]
  };
});

server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
  if (request.params.uri === "file:///example.txt") {
    return {
      contents: [{
        uri: "file:///example.txt",
        mimeType: "text/plain",
        text: "This is the content of the example resource."
      }]
    };
  }
  throw new Error("Resource not found");
});

const transport = new StdioServerTransport();
await server.connect(transport);

While this works, it requires quite a bit of code just to get started. Not only do you need to be familiar with the MCP protocol, but you need to complete a fair amount of set up work (e.g. defining schemas) for every action. Doing it through Workers removes all these barriers, allowing you to spin up an MCP server without the complexity.

We’re always looking for ways to simplify developer workflows, and we’re excited about this new standard to open up more possibilities for interacting with LLMs, and building agents.

If you’re interested in setting this up, check out this tutorial which walks you through these examples. We’re excited to see what you build. Be sure to share your MCP server creations with us on Discord, X, or Bluesky!

How Cloudflare is helping domain owners with the upcoming Entrust CA distrust by Chrome and Mozilla

Post Syndicated from Dina Kozlov original https://blog.cloudflare.com/how-cloudflare-is-helping-domain-owners-with-the-upcoming-entrust-ca

Chrome and Mozilla announced that they will stop trusting Entrust’s public TLS certificates issued after November 12, 2024 and December 1, 2024, respectively. This decision stems from concerns related to Entrust’s ability to meet the CA/Browser Forum’s requirements for a publicly trusted certificate authority (CA). To prevent Entrust customers from being impacted by this change, Entrust has announced that they are partnering with SSL.com, a publicly trusted CA, and will be issuing certs from SSL.com’s roots to ensure that they can continue to provide their customers with certificates that are trusted by Chrome and Mozilla. 

We’re excited to announce that we’re going to be adding SSL.com as a certificate authority that Cloudflare customers can use. This means that Cloudflare customers that are currently relying on Entrust as a CA and uploading their certificate manually to Cloudflare will now be able to rely on Cloudflare’s certificate management pipeline for automatic issuance and renewal of SSL.com certificates. 

CA distrust: responsibilities, repercussions, and responses

With great power comes great responsibility
Every publicly trusted certificate authority (CA) is responsible for maintaining a high standard of security and compliance to ensure that the certificates they issue are trustworthy. The security of millions of websites and applications relies on a CA’s commitment to these standards, which are set by the CA/Browser Forum, the governing body that defines the baseline requirements for certificate authorities. These standards include rules regarding certificate issuance, validation, and revocation, all designed to secure the data transferred over the Internet. 

However, as with all complex software systems, it’s inevitable that bugs or issues may arise, leading to the mis-issuance of certificates. Improperly issued certificates pose a significant risk to Internet security, as they can be exploited by malicious actors to impersonate legitimate websites and intercept sensitive data. 

To mitigate such risk, publicly trusted CAs are required to communicate issues as soon as they are discovered, so that domain owners can replace the compromised certificates immediately. Once the issue is communicated, CAs must revoke the mis-issued certificates within 5 days to signal to browsers and clients that the compromised certificate should no longer be trusted. This level of transparency and urgency around the revocation process is essential for minimizing the risk posed by compromised certificates. 

Why Chrome and Mozilla are distrusting Entrust
The decision made by Chrome and Mozilla to distrust Entrust’s public TLS certificates stems from concerns regarding Entrust’s incident response and remediation process. In several instances, Entrust failed to report critical issues and did not revoke certificates in a timely manner. The pattern of delayed action has eroded the browsers’ confidence in Entrust’s ability to act quickly and transparently, which is crucial for maintaining trust as a CA. 

Google and Mozilla cited the ongoing lack of transparency and urgency in addressing mis-issuances as the primary reason for their distrust decision. Google specifically pointed out that over the past 6 years, Entrust has shown a “pattern of compliance failures” and failed to make the “tangible, measurable progress” necessary to restore trust. Mozilla echoed these concerns, emphasizing the importance of holding Entrust accountable to ensure the integrity and security of the public Internet. 

Entrust’s response to the distrust announcement 
In response to the distrust announcement from Chrome and Mozilla, Entrust has taken proactive steps to ensure continuity for their customers. To prevent service disruption, Entrust has announced that they are partnering with SSL.com, a CA that’s trusted by all major browsers, including Chrome and Mozilla, to issue certificates for their customers. By issuing certificates from SSL.com’s roots, Entrust aims to provide a seamless transition for their customers, ensuring that they can continue to obtain certificates that are recognized and trusted by the browsers their users rely on. 

In addition to their partnership with SSL.com, Entrust stated that they are working on a number of improvements, including changes to their organizational structure, revisions to their incident response process and policies, and a push towards automation to ensure compliant certificate issuances. 

How Cloudflare can help Entrust customers 

Now available: SSL.com as a certificate authority for Advanced Certificate Manager and SSL for SaaS certificates
We’re excited to announce that customers using Advanced Certificate Manager will now be able to select SSL.com as a certificate authority for Advanced certificates and Total TLS certificates. Once the certificate is issued, Cloudflare will handle all future renewals on your behalf. 

By default, Cloudflare will issue SSL.com certificates with a 90 day validity period. However, customers using Advanced Certificate Manager will have the option to set a custom validity period (14, 30, or 90 days) for their SSL.com certificates. In addition, Enterprise customers will have the option to obtain 1-year SSL.com certificates. Every SSL.com certificate order will include 1 RSA and 1 ECDSA certificate.

Note: We are gradually rolling this out and customers should see the CA become available to them through the end of September and into October. 

If you’re using Cloudflare as your DNS provider, there are no additional steps for you to take to get the certificate issued. Cloudflare will validate the ownership of the domain on your behalf to get your SSL.com certificate issued and renewed. 

If you’re using an external DNS provider and have wildcard hostnames on your certificates, DNS based validation will need to be used, which means that you’ll need to add TXT DCV tokens at your DNS provider in order to get the certificate issued. With SSL.com, two tokens are returned for every hostname on the certificate. This is because SSL.com uses different tokens for the RSA and ECDSA certificates. To reduce the overhead around certificate management, we recommend setting up DCV Delegation to allow Cloudflare to place domain control validation (DCV) tokens on your behalf. Once DCV Delegation is set up, Cloudflare will automatically issue, renew, and deploy all future certificates for you. 

Advanced Certificates: selecting SSL.com as a CA through the UI or API
Customers can select SSL.com as a CA through the UI or through the Advanced Certificate API endpoint by specifying “ssl_com” in the certificate_authority parameter. 

If you’d like to use SSL.com as a CA for an advanced certificate, you can select “SSL.com” as your CA when creating a new Advanced certificate order. 


If you’d like to use SSL.com as a CA for all of your certificates, we recommend setting your Total TLS CA to SSL.com. This will issue an individual certificate for each of your proxied hostname from the CA. 

Note: Total TLS is a feature that’s only available to customers that are using Cloudflare as their DNS provider. 


SSL for SaaS: selecting SSL.com as a CA through the UI or API
Enterprise customers can select SSL.com as a CA through the custom hostname creation UI or through the Custom Hostnames API endpoint by specifying “ssl_com” in the certificate_authority parameter. 

All custom hostname certificates issued from SSL.com will have a 90 day validity period. If you have wildcard support enabled for custom hostnames, we recommend using DCV Delegation to ensure that all certificate issuances and renewals are automatic.  

Our recommendation if you’re using Entrust as a certificate authority 

Cloudflare customers that use Entrust as their CA are required to manually handle all certificate issuances and renewals. Since Cloudflare does not directly integrate with Entrust, customers have to get their certificates issued directly from the CA and upload them to Cloudflare as custom certificates. Once these certificates come up for renewal, customers have to repeat this manual process and upload the renewed certificates to Cloudflare before the expiration date. 

Manually managing your certificate’s lifecycle is a time-consuming and error prone process. With certificate lifetimes decreasing from 1 year to 90 days, this cycle needs to be repeated more frequently by the domain owner. 

As Entrust transitions to issuing certificates from SSL.com roots, this manual management process will remain unless customers switch to Cloudflare’s managed certificate pipeline. By making this switch, you can continue to receive SSL.com certificates without the hassle of manual management — Cloudflare will handle all issuances and renewals for you!

In early October, we will be reaching out to customers who have uploaded Entrust certificates to Cloudflare to recommend migrating to our managed pipeline for SSL.com certificate issuances, simplifying your certificate management process. 

If you’re ready to make the transition today, simply go to the SSL/TLS tab in your Cloudflare dashboard, click “Order Advanced Certificate”, and select “SSL.com” as your certificate authority. Once your new SSL.com certificate is issued, you can either remove your Entrust certificate or simply let it expire. Cloudflare will seamlessly transition to serving the managed SSL.com certificate before the Entrust certificate expires, ensuring zero downtime during the switch. 

Avoiding downtime: modern alternatives to outdated certificate pinning practices

Post Syndicated from Dina Kozlov original https://blog.cloudflare.com/why-certificate-pinning-is-outdated


In today’s world, technology is quickly evolving and some practices that were once considered the gold standard are quickly becoming outdated. At Cloudflare, we stay close to industry changes to ensure that we can provide the best solutions to our customers. One practice that we’re continuing to see in use that no longer serves its original purpose is certificate pinning. In this post, we’ll dive into certificate pinning, the consequences of using it in today’s Public Key Infrastructure (PKI) world, and alternatives to pinning that offer the same level of security without the management overhead.  

PKI exists to help issue and manage TLS certificates, which are vital to keeping the Internet secure – they ensure that users access the correct applications or servers and that data between two parties stays encrypted. The mis-issuance of a certificate can pose great risk. For example, if a malicious party is able to issue a TLS certificate for your bank’s website, then they can potentially impersonate your bank and intercept that traffic to get access to your bank account. To prevent a mis-issued certificate from intercepting traffic, the server can give a certificate to the client and say “only trust connections if you see this certificate and drop any responses that present a different certificate” – this practice is called certificate pinning.

In the early 2000s, it was common for banks and other organizations that handle sensitive data to pin certificates to clients. However, over the last 20 years, TLS certificate issuance has evolved and changed, and new solutions have been developed to help customers achieve the security benefit they receive through certificate pinning, with simpler management, and without the risk of disruption.

Cloudflare’s mission is to help build a better Internet, which is why our teams are always focused on keeping domains secure and online.

Why certificate pinning is causing more outages now than it did before

Certificate pinning is not a new practice, so why are we emphasizing the need to stop using it now? The reason is that the PKI ecosystem is moving towards becoming more agile, flexible, and secure. As a part of this change, certificate authorities (CAs) are starting to rotate certificates and their intermediates, certificates that bridge the root certificate and the domain certificate, more frequently to improve security and encourage automation.

These more frequent certificate rotations are problematic from a pinning perspective because certificate pinning relies on the exact matching of certificates. When a certificate is rotated, the new certificate might not match the pinned certificate on the client side. If the pinned certificate is not updated to reflect the contents of the rotated certificate, the client will reject the new certificate, even if it’s valid and issued by the same CA. This mismatch leads to a failure in establishing a secure connection, causing the domain or application to become inaccessible until the pinned certificate is updated.

Since the start of 2024, we have seen the number of customer reported outages caused by certificate pinning significantly increase. (As of this writing, we are part way through July and Q3 has already seen as many outages as the last three quarters of 2023 combined.)

We can attribute this rise to two major events: Cloudflare migrating away from using DigiCert as a certificate authority and Google and Let’s Encrypt intermediate CA rotations.

Before migrating customer’s certificates away from using DigiCert as the CA, Cloudflare sent multiple notifications to customers to inform them that they should update or remove their certificate pins, so that the migration does not impact their domain’s availability.

However, what we’ve learned is that almost all customers that were impacted by the change were unaware that they had a certificate pin in place. One of the consequences of using certificate pinning is that the “set and forget” mentality doesn’t work, now that certificates are being rotated more frequently. Instead, changes need to be closely monitored to ensure that a regular certificate renewal doesn’t cause an outage. This goes to show that to implement certificate pinning successfully, customers need a robust system in place to track certificate changes and implement them.

We built our Universal SSL pipeline to be resilient and redundant, ensuring that we can always issue and renew a TLS certificate on behalf of our customers, even in the event of a compromise or revocation. CAs are starting to make changes like more frequent certificate rotations to encourage a move towards a more secure ecosystem. Now, it’s up to domain owners to stop implementing legacy practices like certificate pinning, which cause breaking changes, and instead start adopting modern standards that aim to provide the same level of security, but without the management overhead or risk.

Modern standards & practices are making the need for certificate pinning obsolete

Shorter certificate lifetimes

Over the last few years, we have seen certificate lifetimes quickly decrease. Before 2011, a certificate could be valid for up to 96 months (eight years) and now, in 2024, the maximum validity period for a certificate is 1 year. We’re seeing this trend continue to develop, with Google Chrome pushing for shorter CA, intermediate, and certificate lifetimes, advocating for 3 month certificate validity as the new standard.

This push improves security and redundancy of the entire PKI ecosystem in several ways. First, it reduces the scope of a compromise by limiting the amount of time that a malicious party could control a TLS certificate or private key. Second, it reduces reliance on certificate revocation, a process that lacks standardization and enforcement by clients, browsers, and CAs. Lastly, it encourages automation as a replacement for legacy certificate practices that are time-consuming and error-prone.

Cloudflare is moving towards only using CAs that follow the ACME (Automated Certificate Management Environment) protocol, which by default, issues certificates with 90 day validity periods. We have already started to roll this out to Universal SSL certificates and have removed the ability to issue 1-year certificates as a part of our reduced usage of DigiCert.

Regular rotation of intermediate certificates

The CAs that Cloudflare partners with, Let’s Encrypt and Google Trust Services, are starting to rotate their intermediate CAs more frequently. This increased rotation is beneficial from a security perspective because it limits the lifespan of intermediate certificates, reducing the window of opportunity for attackers to exploit a compromised intermediate. Additionally, regular rotations make it easier to revoke an intermediate certificate if it becomes compromised, enhancing the overall security and resiliency of the PKI ecosystem.

Both Let’s Encrypt and Google Trust Services changed their intermediate chains in June 2024. In addition, Let’s Encrypt has started to balance their certificate issuance across 10 intermediates (5 RSA and 5 ECDSA).

Cloudflare customers using Advanced Certificate Manager have the ability to choose their issuing CA. The issue is that even if Cloudflare uses the same CA for a certificate renewal, there is no guarantee that the same certificate chain (root or intermediate) will be used to issue the renewed certificate. As a result, if pinning is used, a successful renewal could cause a full outage for a domain or application.

This happens because certificate pinning relies on the exact matching of certificates. When an intermediate certificate is rotated or changed, the new certificate might not match the pinned certificate on the client side. As a result, the client will reject the renewed certificate, even if it’s a valid certificate issued by the same CA. This mismatch leads to a failure on the client side, causing the domain to become inaccessible until the pinned certificate is updated to reflect the new intermediate certificate. This risk of an unexpected outage is a major downside of continuing to use certificate pinning, especially as CAs increasingly update their intermediates as a security measure.

Increased use of certificate transparency

Certificate transparency (CT) logs provide a standardized framework for monitoring and auditing the issuance of TLS certificates. CT logs help detect misissued or malicious certificates and Cloudflare customers can set up CT monitoring to receive notifications about any certificates issued for their domain. This provides a better mechanism for detecting certificate mis-issuance, reducing the need for pinning.

Why modern standards make certificate pinning obsolete

Together, these practices – shorter certificate lifetimes, regular rotations of intermediate certificates, and increased use of certificate transparency – address the core security concerns that certificate pinning was initially designed to mitigate. Shorter lifetimes and frequent rotations limit the impact of compromised certificates, while certificate transparency allows for real time monitoring and detection of misissued certificates. These advancements are automated, scalable, and robust and eliminate the need for the manual and error-prone process of certificate pinning. By adopting these modern standards, organizations can achieve a higher level of security and resiliency without the management overhead and risk associated with certificate pinning.

Reasons behind continued use of certificate pinning

Originally, certificate pinning was designed to prevent monster-in-the-middle (MITM) attacks by associating a hostname with a specific TLS certificate, ensuring that a client could only access an application if the server presented a certificate issued by the domain owner.

Certificate pinning was traditionally used to secure IoT (Internet of Things) devices, mobile applications, and APIs. IoT devices are usually equipped with more limited processing power and are oftentimes unable to perform software updates. As a result, they’re less likely to perform things like certificate revocation checks to ensure that they’re using a valid certificate. As a result, it’s common for these devices to come pre-installed with a set of trusted certificate pins to ensure that they can maintain a high level of security. However, the increased frequency of certificate changes poses significant risk, as many devices have immutable software, preventing timely updates to certificate pins during renewals.

Similarly, certificate pinning has been employed to secure Android and iOS applications, ensuring that only the correct certificates are served. Despite this, both Apple and Google warn developers against the use of certificate pinning due to the potential for failures if not implemented correctly.

Understanding the trade-offs of different certificate pinning implementations

While certificate pinning can be applied at various levels of the certificate chain, offering different levels of granularity and security, we don’t recommend it due to the challenges and risks associated with its use.

Pinning certificates at the root certificate

Pinning the root certificate instructs a client to only trust certificates issued by that specific Certificate Authority (CA).

Advantages:

  • Simplified management: Since root certificates have long lifetimes (>10 years) and rarely change, pinning at the root reduces the need to frequently update certificate pins, making this the easiest option in terms of management overhead.

Disadvantages:

  • Broader trust: Most Certificate Authorities (CAs) issue their certificates from one root, so pinning a root CA certificate enables the client to trust every certificate issued from that CA. However, this broader trust can be problematic. If the root CA is compromised, every certificate issued by that CA is also compromised, which significantly increases the potential scope and impact of a security breach. This broad trust can therefore create a single point of failure, making the entire ecosystem more vulnerable to attacks.
  • Neglected Maintenance: Root certificates are infrequently rotated, which can lead to a “set and forget” mentality when pinning them. Although it’s rare, CAs do change their roots and when this happens, a correctly renewed certificate will break the pin, causing an outage. Since these pins are rarely updated, resolving such outages can be time-consuming as engineering teams try to identify and locate where the outdated pins have been set.

Pinning certificates at the intermediate certificate

Pinning an intermediate certificate instructs a client to only trust certificates issued by a specific intermediate CA, issued from a trusted root CA. With lifetimes ranging from 3 to 10 years, intermediate certificates offer a better balance between security and flexibility.

Advantages:

  • Better security: Narrows down the trust to certificates issued by a specific intermediate CA.
  • Simpler management: With intermediate CA lifetimes spanning a few years, certificate pins require less frequent updates, reducing the maintenance burden.

Disadvantages:

  • Broad trust: While pinning on an intermediate certificate is more restrictive than pinning on a root certificate, it still allows for a broad range of certificates to be trusted.
  • Maintenance: Intermediate certificates are rotated more frequently than root certificates, requiring more regular updates to pinned certificates.
  • Less predictability: With CAs like Let’s Encrypt issuing their certificates from varying intermediates, it’s no longer possible to predict which certificate chain will be used during a renewal, making it more likely for a certificate renewal to break a certificate pin and cause an outage.

Pinning certificates at the leaf certificate

Pinning the leaf certificate instructs a client to only trust that specific certificate. Although this option offers the highest level of security, it also poses the greatest risk of causing an outage during a certificate renewal.

Advantages:

  • High security: Provides the highest level of security by ensuring that only a specific certificate is trusted, minimizing the risk of a monster-in-the-middle attack.

Disadvantages:

  • Risky: Requires careful management of certificate renewals to prevent outages.
  • Management burden: Leaf certificates have shorter lifetimes, with 90 days becoming the standard, requiring constant updates to the certificate pin to avoid a breaking change during a renewal.

Alternatives to certificate pinning

Given the risks and challenges associated with certificate pinning, we recommend the following as more effective and modern alternatives to achieve the same level of security (preventing a mis-issued certificate from intercepting traffic) that certificate pinning aims to provide.

Shorter certificate lifetimes

Using shorter certificate lifetimes ensures that certificates are regularly renewed and replaced, reducing the risk of misuse of a compromised certificate by limiting the window of opportunity for attackers.

By default, Cloudflare issues 90-day certificates for customers. Customers using Advanced Certificate Manager can request TLS certificates with lifetimes as short as 14 days.

CAA records to restrict which CAs can issue certificates for a domain

Certification Authority Authorization (CAA) DNS records allow domain owners to specify which CAs are allowed to issue certificates for their domain. This adds an extra layer of security by restricting issuance to trusted authorities, providing a similar benefit as pinning a root CA certificate. For example, if you’re using Google Trust Services as your CA, you can add the following CAA DNS record to ensure that only that CA issues certificates for your domain:

example.com         CAA 0 issue "pki.goog"

By default, Cloudflare sets CAA records on behalf of customers to ensure that certificates can be issued from the CAs that Cloudflare partners with. Customers can choose to further restrict that list of CAs by adding their own CAA records.

Certificate Transparency & monitoring

Certificate Transparency (CT) provides the ability to monitor and audit certificate issuances. By logging certificates in publicly accessible CT logs, organizations are able to monitor, detect, and respond to misissued certificates at the time they are issued.

Cloudflare customers can set up CT Monitoring to receive notifications when certificates are issued in their domain. Today, we notify customers using the product about all certificates issued for their domains. In the future, we will allow customers to filter those notifications, so that they are only notified when an external party that isn’t Cloudflare issues a certificate for the owner’s domain. This product is available to all customers and can be enabled with the click of a button.

Multi-vantage point Domain Control Validation (DCV) checks to prevent mis-issuances

For a CA to issue a certificate, the domain owner needs to prove ownership of the domain by serving Domain Control Validation (DCV) records. While uncommon, one attack vector of DCV validation allows an actor to perform BGP hijacking to spoof the DNS response and trick a CA into mis-issuing a certificate. To prevent this form of attack, CAs have started to perform DCV validation checks from multiple locations to ensure that a certificate is only issued when a full quorum is met.

Cloudflare has developed its own solution that CAs can use to perform multi vantage point DCV checks. In addition, Cloudflare partners with CAs like Let’s Encrypt who continue to develop these checks to support new locations, reducing the risk of a certificate mis-issuance.

Specifying ACME account URI in CAA records

A new enhancement to the ACME protocol allows certificate requesting parties to specify an ACME account URI, the ID of the ACME account that will be requesting the certificates, in CAA records to tighten control over the certificate issuance process. This ensures that only certificates issued through an authorized ACME account are trusted, adding another layer of verification to certificate issuance. Let’s Encrypt supports this extension to CAA records which allows users with a Let’s Encrypt certificate to set a CAA DNS record, such as the following:

example.com         CAA 0 issue "letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/<account_id>"

With this record, Let’s Encrypt subscribers can ensure that only Let’s Encrypt can issue certificates for their domain and that these certificates were only issued through their ACME account.

Cloudflare will look to support this enhancement automatically for customers in the future.

Conclusion

Years ago, certificate pinning was a valuable tool for enhancing security, but over the last 20 years, it has failed to keep up with new advancements in the certificate ecosystem. As a result, instead of providing the intended security benefit, it has increased the number of outages caused during a successful certificate renewal. With new enhancements in certificate issuance standards and certificate transparency, we’re encouraging our customers and the industry to move towards adopting those new standards and deprecating old ones.

If you’re a Cloudflare customer and are required to pin your certificate, the only way to ensure a zero-downtime renewal is to upload your own custom certificates. We recommend using the staging network to test your certificate renewal to ensure you have updated your certificate pin.

Avoiding downtime: modern alternatives to outdated certificate pinning practices

Post Syndicated from Dina Kozlov original https://blog.cloudflare.com/why-certificate-pinning-is-outdated


In today’s world, technology is quickly evolving and some practices that were once considered the gold standard are quickly becoming outdated. At Cloudflare, we stay close to industry changes to ensure that we can provide the best solutions to our customers. One practice that we’re continuing to see in use that no longer serves its original purpose is certificate pinning. In this post, we’ll dive into certificate pinning, the consequences of using it in today’s Public Key Infrastructure (PKI) world, and alternatives to pinning that offer the same level of security without the management overhead.  

PKI exists to help issue and manage TLS certificates, which are vital to keeping the Internet secure – they ensure that users access the correct applications or servers and that data between two parties stays encrypted. The mis-issuance of a certificate can pose great risk. For example, if a malicious party is able to issue a TLS certificate for your bank’s website, then they can potentially impersonate your bank and intercept that traffic to get access to your bank account. To prevent a mis-issued certificate from intercepting traffic, the server can give a certificate to the client and say “only trust connections if you see this certificate and drop any responses that present a different certificate” – this practice is called certificate pinning.

In the early 2000s, it was common for banks and other organizations that handle sensitive data to pin certificates to clients. However, over the last 20 years, TLS certificate issuance has evolved and changed, and new solutions have been developed to help customers achieve the security benefit they receive through certificate pinning, with simpler management, and without the risk of disruption.

Cloudflare’s mission is to help build a better Internet, which is why our teams are always focused on keeping domains secure and online.

Why certificate pinning is causing more outages now than it did before

Certificate pinning is not a new practice, so why are we emphasizing the need to stop using it now? The reason is that the PKI ecosystem is moving towards becoming more agile, flexible, and secure. As a part of this change, certificate authorities (CAs) are starting to rotate certificates and their intermediates, certificates that bridge the root certificate and the domain certificate, more frequently to improve security and encourage automation.

These more frequent certificate rotations are problematic from a pinning perspective because certificate pinning relies on the exact matching of certificates. When a certificate is rotated, the new certificate might not match the pinned certificate on the client side. If the pinned certificate is not updated to reflect the contents of the rotated certificate, the client will reject the new certificate, even if it’s valid and issued by the same CA. This mismatch leads to a failure in establishing a secure connection, causing the domain or application to become inaccessible until the pinned certificate is updated.

Since the start of 2024, we have seen the number of customer reported outages caused by certificate pinning significantly increase. (As of this writing, we are part way through July and Q3 has already seen as many outages as the last three quarters of 2023 combined.)

We can attribute this rise to two major events: Cloudflare migrating away from using DigiCert as a certificate authority and Google and Let’s Encrypt intermediate CA rotations.

Before migrating customer’s certificates away from using DigiCert as the CA, Cloudflare sent multiple notifications to customers to inform them that they should update or remove their certificate pins, so that the migration does not impact their domain’s availability.

However, what we’ve learned is that almost all customers that were impacted by the change were unaware that they had a certificate pin in place. One of the consequences of using certificate pinning is that the “set and forget” mentality doesn’t work, now that certificates are being rotated more frequently. Instead, changes need to be closely monitored to ensure that a regular certificate renewal doesn’t cause an outage. This goes to show that to implement certificate pinning successfully, customers need a robust system in place to track certificate changes and implement them.

We built our Universal SSL pipeline to be resilient and redundant, ensuring that we can always issue and renew a TLS certificate on behalf of our customers, even in the event of a compromise or revocation. CAs are starting to make changes like more frequent certificate rotations to encourage a move towards a more secure ecosystem. Now, it’s up to domain owners to stop implementing legacy practices like certificate pinning, which cause breaking changes, and instead start adopting modern standards that aim to provide the same level of security, but without the management overhead or risk.

Modern standards & practices are making the need for certificate pinning obsolete

Shorter certificate lifetimes

Over the last few years, we have seen certificate lifetimes quickly decrease. Before 2011, a certificate could be valid for up to 96 months (eight years) and now, in 2024, the maximum validity period for a certificate is 1 year. We’re seeing this trend continue to develop, with Google Chrome pushing for shorter CA, intermediate, and certificate lifetimes, advocating for 3 month certificate validity as the new standard.

This push improves security and redundancy of the entire PKI ecosystem in several ways. First, it reduces the scope of a compromise by limiting the amount of time that a malicious party could control a TLS certificate or private key. Second, it reduces reliance on certificate revocation, a process that lacks standardization and enforcement by clients, browsers, and CAs. Lastly, it encourages automation as a replacement for legacy certificate practices that are time-consuming and error-prone.

Cloudflare is moving towards only using CAs that follow the ACME (Automated Certificate Management Environment) protocol, which by default, issues certificates with 90 day validity periods. We have already started to roll this out to Universal SSL certificates and have removed the ability to issue 1-year certificates as a part of our reduced usage of DigiCert.

Regular rotation of intermediate certificates

The CAs that Cloudflare partners with, Let’s Encrypt and Google Trust Services, are starting to rotate their intermediate CAs more frequently. This increased rotation is beneficial from a security perspective because it limits the lifespan of intermediate certificates, reducing the window of opportunity for attackers to exploit a compromised intermediate. Additionally, regular rotations make it easier to revoke an intermediate certificate if it becomes compromised, enhancing the overall security and resiliency of the PKI ecosystem.

Both Let’s Encrypt and Google Trust Services changed their intermediate chains in June 2024. In addition, Let’s Encrypt has started to balance their certificate issuance across 10 intermediates (5 RSA and 5 ECDSA).

Cloudflare customers using Advanced Certificate Manager have the ability to choose their issuing CA. The issue is that even if Cloudflare uses the same CA for a certificate renewal, there is no guarantee that the same certificate chain (root or intermediate) will be used to issue the renewed certificate. As a result, if pinning is used, a successful renewal could cause a full outage for a domain or application.

This happens because certificate pinning relies on the exact matching of certificates. When an intermediate certificate is rotated or changed, the new certificate might not match the pinned certificate on the client side. As a result, the client will reject the renewed certificate, even if it’s a valid certificate issued by the same CA. This mismatch leads to a failure on the client side, causing the domain to become inaccessible until the pinned certificate is updated to reflect the new intermediate certificate. This risk of an unexpected outage is a major downside of continuing to use certificate pinning, especially as CAs increasingly update their intermediates as a security measure.

Increased use of certificate transparency

Certificate transparency (CT) logs provide a standardized framework for monitoring and auditing the issuance of TLS certificates. CT logs help detect misissued or malicious certificates and Cloudflare customers can set up CT monitoring to receive notifications about any certificates issued for their domain. This provides a better mechanism for detecting certificate mis-issuance, reducing the need for pinning.

Why modern standards make certificate pinning obsolete

Together, these practices – shorter certificate lifetimes, regular rotations of intermediate certificates, and increased use of certificate transparency – address the core security concerns that certificate pinning was initially designed to mitigate. Shorter lifetimes and frequent rotations limit the impact of compromised certificates, while certificate transparency allows for real time monitoring and detection of misissued certificates. These advancements are automated, scalable, and robust and eliminate the need for the manual and error-prone process of certificate pinning. By adopting these modern standards, organizations can achieve a higher level of security and resiliency without the management overhead and risk associated with certificate pinning.

Reasons behind continued use of certificate pinning

Originally, certificate pinning was designed to prevent monster-in-the-middle (MITM) attacks by associating a hostname with a specific TLS certificate, ensuring that a client could only access an application if the server presented a certificate issued by the domain owner.

Certificate pinning was traditionally used to secure IoT (Internet of Things) devices, mobile applications, and APIs. IoT devices are usually equipped with more limited processing power and are oftentimes unable to perform software updates. As a result, they’re less likely to perform things like certificate revocation checks to ensure that they’re using a valid certificate. As a result, it’s common for these devices to come pre-installed with a set of trusted certificate pins to ensure that they can maintain a high level of security. However, the increased frequency of certificate changes poses significant risk, as many devices have immutable software, preventing timely updates to certificate pins during renewals.

Similarly, certificate pinning has been employed to secure Android and iOS applications, ensuring that only the correct certificates are served. Despite this, both Apple and Google warn developers against the use of certificate pinning due to the potential for failures if not implemented correctly.

Understanding the trade-offs of different certificate pinning implementations

While certificate pinning can be applied at various levels of the certificate chain, offering different levels of granularity and security, we don’t recommend it due to the challenges and risks associated with its use.

Pinning certificates at the root certificate

Pinning the root certificate instructs a client to only trust certificates issued by that specific Certificate Authority (CA).

Advantages:

  • Simplified management: Since root certificates have long lifetimes (>10 years) and rarely change, pinning at the root reduces the need to frequently update certificate pins, making this the easiest option in terms of management overhead.

Disadvantages:

  • Broader trust: Most Certificate Authorities (CAs) issue their certificates from one root, so pinning a root CA certificate enables the client to trust every certificate issued from that CA. However, this broader trust can be problematic. If the root CA is compromised, every certificate issued by that CA is also compromised, which significantly increases the potential scope and impact of a security breach. This broad trust can therefore create a single point of failure, making the entire ecosystem more vulnerable to attacks.

  • Neglected Maintenance: Root certificates are infrequently rotated, which can lead to a “set and forget” mentality when pinning them. Although it’s rare, CAs do change their roots and when this happens, a correctly renewed certificate will break the pin, causing an outage. Since these pins are rarely updated, resolving such outages can be time-consuming as engineering teams try to identify and locate where the outdated pins have been set.

Pinning certificates at the intermediate certificate

Pinning an intermediate certificate instructs a client to only trust certificates issued by a specific intermediate CA, issued from a trusted root CA. With lifetimes ranging from 3 to 10 years, intermediate certificates offer a better balance between security and flexibility.

Advantages:

  • Better security: Narrows down the trust to certificates issued by a specific intermediate CA.

  • Simpler management: With intermediate CA lifetimes spanning a few years, certificate pins require less frequent updates, reducing the maintenance burden.

Disadvantages:

  • Broad trust: While pinning on an intermediate certificate is more restrictive than pinning on a root certificate, it still allows for a broad range of certificates to be trusted.

  • Maintenance: Intermediate certificates are rotated more frequently than root certificates, requiring more regular updates to pinned certificates.

  • Less predictability: With CAs like Let’s Encrypt issuing their certificates from varying intermediates, it’s no longer possible to predict which certificate chain will be used during a renewal, making it more likely for a certificate renewal to break a certificate pin and cause an outage.

Pinning certificates at the leaf certificate

Pinning the leaf certificate instructs a client to only trust that specific certificate. Although this option offers the highest level of security, it also poses the greatest risk of causing an outage during a certificate renewal.

Advantages:

  • High security: Provides the highest level of security by ensuring that only a specific certificate is trusted, minimizing the risk of a monster-in-the-middle attack.

Disadvantages:

  • Risky: Requires careful management of certificate renewals to prevent outages.

  • Management burden: Leaf certificates have shorter lifetimes, with 90 days becoming the standard, requiring constant updates to the certificate pin to avoid a breaking change during a renewal.

Alternatives to certificate pinning

Given the risks and challenges associated with certificate pinning, we recommend the following as more effective and modern alternatives to achieve the same level of security (preventing a mis-issued certificate from intercepting traffic) that certificate pinning aims to provide.

Shorter certificate lifetimes

Using shorter certificate lifetimes ensures that certificates are regularly renewed and replaced, reducing the risk of misuse of a compromised certificate by limiting the window of opportunity for attackers.

By default, Cloudflare issues 90-day certificates for customers. Customers using Advanced Certificate Manager can request TLS certificates with lifetimes as short as 14 days.

CAA records to restrict which CAs can issue certificates for a domain

Certification Authority Authorization (CAA) DNS records allow domain owners to specify which CAs are allowed to issue certificates for their domain. This adds an extra layer of security by restricting issuance to trusted authorities, providing a similar benefit as pinning a root CA certificate. For example, if you’re using Google Trust Services as your CA, you can add the following CAA DNS record to ensure that only that CA issues certificates for your domain:

example.com         CAA 0 issue "pki.goog"

By default, Cloudflare sets CAA records on behalf of customers to ensure that certificates can be issued from the CAs that Cloudflare partners with. Customers can choose to further restrict that list of CAs by adding their own CAA records.

Certificate Transparency & monitoring

Certificate Transparency (CT) provides the ability to monitor and audit certificate issuances. By logging certificates in publicly accessible CT logs, organizations are able to monitor, detect, and respond to misissued certificates at the time they are issued.

Cloudflare customers can set up CT Monitoring to receive notifications when certificates are issued in their domain. Today, we notify customers using the product about all certificates issued for their domains. In the future, we will allow customers to filter those notifications, so that they are only notified when an external party that isn’t Cloudflare issues a certificate for the owner’s domain. This product is available to all customers and can be enabled with the click of a button.

Multi-vantage point Domain Control Validation (DCV) checks to prevent mis-issuances

For a CA to issue a certificate, the domain owner needs to prove ownership of the domain by serving Domain Control Validation (DCV) records. While uncommon, one attack vector of DCV validation allows an actor to perform BGP hijacking to spoof the DNS response and trick a CA into mis-issuing a certificate. To prevent this form of attack, CAs have started to perform DCV validation checks from multiple locations to ensure that a certificate is only issued when a full quorum is met.

Cloudflare has developed its own solution that CAs can use to perform multi vantage point DCV checks. In addition, Cloudflare partners with CAs like Let’s Encrypt who continue to develop these checks to support new locations, reducing the risk of a certificate mis-issuance.

Specifying ACME account URI in CAA records

A new enhancement to the ACME protocol allows certificate requesting parties to specify an ACME account URI, the ID of the ACME account that will be requesting the certificates, in CAA records to tighten control over the certificate issuance process. This ensures that only certificates issued through an authorized ACME account are trusted, adding another layer of verification to certificate issuance. Let’s Encrypt supports this extension to CAA records which allows users with a Let’s Encrypt certificate to set a CAA DNS record, such as the following:

example.com         CAA 0 issue "letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/"

With this record, Let’s Encrypt subscribers can ensure that only Let’s Encrypt can issue certificates for their domain and that these certificates were only issued through their ACME account.

Cloudflare will look to support this enhancement automatically for customers in the future.

Conclusion

Years ago, certificate pinning was a valuable tool for enhancing security, but over the last 20 years, it has failed to keep up with new advancements in the certificate ecosystem. As a result, instead of providing the intended security benefit, it has increased the number of outages caused during a successful certificate renewal. With new enhancements in certificate issuance standards and certificate transparency, we’re encouraging our customers and the industry to move towards adopting those new standards and deprecating old ones.

If you’re a Cloudflare customer and are required to pin your certificate, the only way to ensure a zero-downtime renewal is to upload your own custom certificates. We recommend using the staging network to test your certificate renewal to ensure you have updated your certificate pin.

How we ensure Cloudflare customers aren’t affected by Let’s Encrypt’s certificate chain change

Post Syndicated from Dina Kozlov original https://blog.cloudflare.com/shortening-lets-encrypt-change-of-trust-no-impact-to-cloudflare-customers


Let’s Encrypt, a publicly trusted certificate authority (CA) that Cloudflare uses to issue TLS certificates, has been relying on two distinct certificate chains. One is cross-signed with IdenTrust, a globally trusted CA that has been around since 2000, and the other is Let’s Encrypt’s own root CA, ISRG Root X1. Since Let’s Encrypt launched, ISRG Root X1 has been steadily gaining its own device compatibility.

On September 30, 2024, Let’s Encrypt’s certificate chain cross-signed with IdenTrust will expire. After the cross-sign expires, servers will no longer be able to serve certificates signed by the cross-signed chain. Instead, all Let’s Encrypt certificates will use the ISRG Root X1 CA.

Most devices and browser versions released after 2016 will not experience any issues as a result of the change since the ISRG Root X1 will already be installed in those clients’ trust stores. That’s because these modern browsers and operating systems were built to be agile and flexible, with upgradeable trust stores that can be updated to include new certificate authorities.

The change in the certificate chain will impact legacy devices and systems, such as devices running Android version 7.1.1 (released in 2016) or older, as those exclusively rely on the cross-signed chain and lack the ISRG X1 root in their trust store. These clients will encounter TLS errors or warnings when accessing domains secured by a Let’s Encrypt certificate. We took a look at the data ourselves and found that, of all Android requests, 2.96% of them come from devices that will be affected by the change. That’s a substantial portion of traffic that will lose access to the Internet. We’re committed to keeping those users online and will modify our certificate pipeline so that we can continue to serve users on older devices without requiring any manual modifications from our customers.

A better Internet, for everyone

In the past, we invested in efforts like “No Browsers Left Behind” to help ensure that we could continue to support clients as SHA-1 based algorithms were being deprecated. Now, we’re applying the same approach for the upcoming Let’s Encrypt change.

We have made the decision to remove Let’s Encrypt as a certificate authority from all flows where Cloudflare dictates the CA, impacting Universal SSL customers and those using SSL for SaaS with the “default CA” choice.

Starting in June 2024, one certificate lifecycle (90 days) before the cross-sign chain expires, we’ll begin migrating Let’s Encrypt certificates that are up for renewal to use a different CA, one that ensures compatibility with older devices affected by the change. That means that going forward, customers will only receive Let’s Encrypt certificates if they explicitly request Let’s Encrypt as the CA.

The change that Let’s Encrypt is making is a necessary one. For us to move forward in supporting new standards and protocols, we need to make the Public Key Infrastructure (PKI) ecosystem more agile. By retiring the cross-signed chain, Let’s Encrypt is pushing devices, browsers, and clients to support adaptable trust stores.

However, we’ve observed changes like this in the past and while they push the adoption of new standards, they disproportionately impact users in economically disadvantaged regions, where access to new technology is limited.

Our mission is to help build a better Internet and that means supporting users worldwide. We previously published a blog post about the Let’s Encrypt change, asking customers to switch their certificate authority if they expected any impact. However, determining the impact of the change is challenging. Error rates due to trust store incompatibility are primarily logged on clients, reducing the visibility that domain owners have. In addition, while there might be no requests incoming from incompatible devices today, it doesn’t guarantee uninterrupted access for a user tomorrow.

Cloudflare’s certificate pipeline has evolved over the years to be resilient and flexible, allowing us to seamlessly adapt to changes like this without any negative impact to our customers.  

How Cloudflare has built a robust TLS certificate pipeline

Today, Cloudflare manages tens of millions of certificates on behalf of customers. For us, a successful pipeline means:

  1. Customers can always obtain a TLS certificate for their domain
  2. CA related issues have zero impact on our customer’s ability to obtain a certificate
  3. The best security practices and modern standards are utilized
  4. Optimizing for future scale
  5. Supporting a wide range of clients and devices

Every year, we introduce new optimizations into our certificate pipeline to maintain the highest level of service. Here’s how we do it…

Ensuring customers can always obtain a TLS certificate for their domain

Since the launch of Universal SSL in 2014, Cloudflare has been responsible for issuing and serving a TLS certificate for every domain that’s protected by our network. That might seem trivial, but there are a few steps that have to successfully execute in order for a domain to receive a certificate:

  1. Domain owners need to complete Domain Control Validation for every certificate issuance and renewal.
  2. The certificate authority needs to verify the Domain Control Validation tokens to issue the certificate.
  3. CAA records, which dictate which CAs can be used for a domain, need to be checked to ensure only authorized parties can issue the certificate.
  4. The certificate authority must be available to issue the certificate.

Each of these steps requires coordination across a number of parties — domain owners, CDNs, and certificate authorities. At Cloudflare, we like to be in control when it comes to the success of our platform. That’s why we make it our job to ensure each of these steps can be successfully completed.

We ensure that every certificate issuance and renewal requires minimal effort from our customers. To get a certificate, a domain owner has to complete Domain Control Validation (DCV) to prove that it does in fact own the domain. Once the certificate request is initiated, the CA will return DCV tokens which the domain owner will need to place in a DNS record or an HTTP token. If you’re using Cloudflare as your DNS provider, Cloudflare completes DCV on your behalf by automatically placing the TXT token returned from the CA into your DNS records. Alternatively, if you use an external DNS provider, we offer the option to Delegate DCV to Cloudflare for automatic renewals without any customer intervention.

Once DCV tokens are placed, Certificate Authorities (CAs) verify them. CAs conduct this verification from multiple vantage points to prevent spoofing attempts. However, since these checks are done from multiple countries and ASNs (Autonomous Systems), they may trigger a Cloudflare WAF rule which can cause the DCV check to get blocked. We made sure to update our WAF and security engine to recognize that these requests are coming from a CA to ensure they’re never blocked so DCV can be successfully completed.

Some customers have CA preferences, due to internal requirements or compliance regulations. To prevent an unauthorized CA from issuing a certificate for a domain, the domain owner can create a Certification Authority Authorization (CAA) DNS record, specifying which CAs are allowed to issue a certificate for that domain. To ensure that customers can always obtain a certificate, we check the CAA records before requesting a certificate to know which CAs we should use. If the CAA records block all of the CAs that are available in Cloudflare’s pipeline and the customer has not uploaded a certificate from the CA of their choice, then we add CAA records on our customers’ behalf to ensure that they can get a certificate issued. Where we can, we optimize for preference. Otherwise, it’s our job to prevent an outage by ensuring that there’s always a TLS certificate available for the domain, even if it does not come from a preferred CA.

Today, Cloudflare is not a publicly trusted certificate authority, so we rely on the CAs that we use to be highly available. But, 100% uptime is an unrealistic expectation. Instead, our pipeline needs to be prepared in case our CAs become unavailable.

Ensuring that CA-related issues have zero impact on our customer’s ability to obtain a certificate

At Cloudflare, we like to think ahead, which means preventing incidents before they happen. It’s not uncommon for CAs to become unavailable — sometimes this happens because of an outage, but more commonly, CAs have maintenance periods every so often where they become unavailable for some period of time.

It’s our job to ensure CA redundancy, which is why we always have multiple CAs ready to issue a certificate, ensuring high availability at all times. If you’ve noticed different CAs issuing your Universal SSL certificates, that’s intentional. We evenly distribute the load across our CAs to avoid any single point of failure. Plus, we keep a close eye on latency and error rates to detect any issues and automatically switch to a different CA that’s available and performant. You may not know this, but one of our CAs has around 4 scheduled maintenance periods every month. When this happens, our automated systems kick in seamlessly, keeping everything running smoothly. This works so well that our internal teams don’t get paged anymore because everything just works.

Adopting best security practices and modern standards  

Security has always been, and will continue to be, Cloudflare’s top priority, and so maintaining the highest security standards to safeguard our customer’s data and private keys is crucial.

Over the past decade, the CA/Browser Forum has advocated for reducing certificate lifetimes from 5 years to 90 days as the industry norm. This shift helps minimize the risk of a key compromise. When certificates are renewed every 90 days, their private keys remain valid for only that period, reducing the window of time that a bad actor can make use of the compromised material.

We fully embrace this change and have made 90 days the default certificate validity period. This enhances our security posture by ensuring regular key rotations, and has pushed us to develop tools like DCV Delegation that promote automation around frequent certificate renewals, without the added overhead. It’s what enables us to offer certificates with validity periods as low as two weeks, for customers that want to rotate their private keys at a high frequency without any concern that it will lead to certificate renewal failures.

Cloudflare has always been at the forefront of new protocols and standards. It’s no secret that when we support a new protocol, adoption skyrockets. This month, we will be adding ECDSA support for certificates issued from Google Trust Services. With ECDSA, you get the same level of security as RSA but with smaller keys. Smaller keys mean smaller certificates and less data passed around to establish a TLS connection, which results in quicker connections and faster loading times.

Optimizing for future scale

Today, Cloudflare issues almost 1 million certificates per day. With the recent shift towards shorter certificate lifetimes, we continue to improve our pipeline to be more robust. But even if our pipeline can handle the significant load, we still need to rely on our CAs to be able to scale with us. With every CA that we integrate, we instantly become one of their biggest consumers. We hold our CAs to high standards and push them to improve their infrastructure to scale. This doesn’t just benefit Cloudflare’s customers, but it helps the Internet by requiring CAs to handle higher volumes of issuance.

And now, with Let’s Encrypt shortening their chain of trust, we’re going to add an additional improvement to our pipeline — one that will ensure the best device compatibility for all.

Supporting all clients — legacy and modern

The upcoming Let’s Encrypt change will prevent legacy devices from making requests to domains or applications that are protected by a Let’s Encrypt certificate. We don’t want to cut off Internet access from any part of the world, which means that we’re going to continue to provide the best device compatibility to our customers, despite the change.

Because of all the recent enhancements, we are able to reduce our reliance on Let’s Encrypt without impacting the reliability or quality of service of our certificate pipeline. One certificate lifecycle (90 days) before the change, we are going to start shifting certificates to use a different CA, one that’s compatible with the devices that will be impacted. By doing this, we’ll mitigate any impact without any action required from our customers. The only customers that will continue to use Let’s Encrypt are ones that have specifically chosen Let’s Encrypt as the CA.

What to expect of the upcoming Let’s Encrypt change

Let’s Encrypt’s cross-signed chain will expire on September 30th, 2024. Although Let’s Encrypt plans to stop issuing certificates from this chain on June 6th, 2024, Cloudflare will continue to serve the cross-signed chain for all Let’s Encrypt certificates until September 9th, 2024.

90 days or one certificate lifecycle before the change, we are going to start shifting Let’s Encrypt certificates to use a different certificate authority. We’ll make this change for all products where Cloudflare is responsible for the CA selection, meaning this will be automatically done for customers using Universal SSL and SSL for SaaS with the “default CA” choice.

Any customers that have specifically chosen Let’s Encrypt as their CA will receive an email notification with a list of their Let’s Encrypt certificates and information on whether or not we’re seeing requests on those hostnames coming from legacy devices.

After September 9th, 2024, Cloudflare will serve all Let’s Encrypt certificates using the ISRG Root X1 chain. Here is what you should expect based on the certificate product that you’re using:

Universal SSL

With Universal SSL, Cloudflare chooses the CA that is used for the domain’s certificate. This gives us the power to choose the best certificate for our customers. If you are using Universal SSL, there are no changes for you to make to prepare for this change. Cloudflare will automatically shift your certificate to use a more compatible CA.

Advanced Certificates

With Advanced Certificate Manager, customers specifically choose which CA they want to use. If Let’s Encrypt was specifically chosen as the CA for a certificate, we will respect the choice, because customers may have specifically chosen this CA due to internal requirements, or because they have implemented certificate pinning, which we highly discourage.

If we see that a domain using an Advanced certificate issued from Let’s Encrypt will be impacted by the change, then we will send out email notifications to inform those customers which certificates are using Let’s Encrypt as their CA and whether or not those domains are receiving requests from clients that will be impacted by the change. Customers will be responsible for changing the CA to another provider, if they chose to do so.

SSL for SaaS

With SSL for SaaS, customers have two options: using a default CA, meaning Cloudflare will choose the issuing authority, or specifying which CA to use.

If you’re leaving the CA choice up to Cloudflare, then we will automatically use a CA with higher device compatibility.

If you’re specifying a certain CA for your custom hostnames, then we will respect that choice. We will send an email out to SaaS providers and platforms to inform them which custom hostnames are receiving requests from legacy devices. Customers will be responsible for changing the CA to another provider, if they chose to do so.

Custom Certificates

If you directly integrate with Let’s Encrypt and use Custom Certificates to upload your Let’s Encrypt certs to Cloudflare then your certificates will be bundled with the cross-signed chain, as long as you choose the bundle method “compatible” or “modern” and upload those certificates before September 9th, 2024. After September 9th, we will bundle all Let’s Encrypt certificates with the ISRG Root X1 chain. With the “user-defined” bundle method, we always serve the chain that’s uploaded to Cloudflare. If you upload Let’s Encrypt certificates using this method, you will need to ensure that certificates uploaded after September 30th, 2024, the date of the CA expiration, contain the right certificate chain.

In addition, if you control the clients that are connecting to your application, we recommend updating the trust store to include the ISRG Root X1. If you use certificate pinning, remove or update your pin. In general, we discourage all customers from pinning their certificates, as this usually leads to issues during certificate renewals or CA changes.

Conclusion

Internet standards will continue to evolve and improve. As we support and embrace those changes, we also need to recognize that it’s our responsibility to keep users online and to maintain Internet access in the parts of the world where new technology is not readily available. By using Cloudflare, you always have the option to choose the setup that’s best for your application.

For additional information regarding the change, please refer to our developer documentation.

Upcoming Let’s Encrypt certificate chain change and impact for Cloudflare customers

Post Syndicated from Dina Kozlov original https://blog.cloudflare.com/upcoming-lets-encrypt-certificate-chain-change-and-impact-for-cloudflare-customers


Let’s Encrypt, a publicly trusted certificate authority (CA) that Cloudflare uses to issue TLS certificates, has been relying on two distinct certificate chains. One is cross-signed with IdenTrust, a globally trusted CA that has been around since 2000, and the other is Let’s Encrypt’s own root CA, ISRG Root X1. Since Let’s Encrypt launched, ISRG Root X1 has been steadily gaining its own device compatibility.

On September 30, 2024, Let’s Encrypt’s certificate chain cross-signed with IdenTrust will expire. To proactively prepare for this change, on May 15, 2024, Cloudflare will stop issuing certificates from the cross-signed chain and will instead use Let’s Encrypt’s ISRG Root X1 chain for all future Let’s Encrypt certificates.

The change in the certificate chain will impact legacy devices and systems, such as Android devices version 7.1.1 or older, as those exclusively rely on the cross-signed chain and lack the ISRG X1 root in their trust store. These clients may encounter TLS errors or warnings when accessing domains secured by a Let’s Encrypt certificate.

According to Let’s Encrypt, more than 93.9% of Android devices already trust the ISRG Root X1 and this number is expected to increase in 2024, especially as Android releases version 14, which makes the Android trust store easily and automatically upgradable.

We took a look at the data ourselves and found that, from all Android requests, 2.96% of them come from devices that will be affected by the change. In addition, only 1.13% of all requests from Firefox come from affected versions, which means that most (98.87%) of the requests coming from Android versions that are using Firefox will not be impacted.

Preparing for the change

If you’re worried about the change impacting your clients, there are a few things that you can do to reduce the impact of the change. If you control the clients that are connecting to your application, we recommend updating the trust store to include the ISRG Root X1. If you use certificate pinning, remove or update your pin. In general, we discourage all customers from pinning their certificates, as this usually leads to issues during certificate renewals or CA changes.

If you experience issues with the Let’s Encrypt chain change, and you’re using Advanced Certificate Manager or SSL for SaaS on the Enterprise plan, you can choose to switch your certificate to use Google Trust Services as the certificate authority instead.

For more information, please refer to our developer documentation.

While this change will impact a very small portion of clients, we support the shift that Let’s Encrypt is making as it supports a more secure and agile Internet.

Embracing change to move towards a better Internet

Looking back, there were a number of challenges that slowed down the adoption of new technologies and standards that helped make the Internet faster, more secure, and more reliable.

For starters, before Cloudflare launched Universal SSL, free certificates were not attainable. Instead, domain owners had to pay around $100 to get a TLS certificate. For a small business, this is a big cost and without browsers enforcing TLS, this significantly hindered TLS adoption for years. Insecure algorithms have taken decades to deprecate due to lack of support of new algorithms in browsers or devices. We learned this lesson while deprecating SHA-1.

Supporting new security standards and protocols is vital for us to continue improving the Internet. Over the years, big and sometimes risky changes were made in order for us to move forward. The launch of Let’s Encrypt in 2015 was monumental. Let’s Encrypt allowed every domain to get a TLS certificate for free, which paved the way to a more secure Internet, with now around 98% of traffic using HTTPS.

In 2014, Cloudflare launched elliptic curve digital signature algorithm (ECDSA) support for Cloudflare-issued certificates and made the decision to issue ECDSA-only certificates to free customers. This boosted ECDSA adoption by pressing clients and web operators to make changes to support the new algorithm, which provided the same (if not better) security as RSA while also improving performance. In addition to that, modern browsers and operating systems are now being built in a way that allows them to constantly support new standards, so that they can deprecate old ones.

For us to move forward in supporting new standards and protocols, we need to make the Public Key Infrastructure (PKI) ecosystem more agile. By retiring the cross-signed chain, Let’s Encrypt is pushing devices, browsers, and clients to support adaptable trust stores. This allows clients to support new standards without causing a breaking change. It also lays the groundwork for new certificate authorities to emerge.

Today, one of the main reasons why there’s a limited number of CAs available is that it takes years for them to become widely trusted, that is, without cross-signing with another CA. In 2017, Google launched a new publicly trusted CA, Google Trust Services, that issued free TLS certificates. Even though they launched a few years after Let’s Encrypt, they faced the same challenges with device compatibility and adoption, which caused them to cross-sign with GlobalSign’s CA. We hope that, by the time GlobalSign’s CA comes up for expiration, almost all traffic is coming from a modern client and browser, meaning the change impact should be minimal.

Birthday Week recap: everything we announced — plus an AI-powered opportunity for startups

Post Syndicated from Dina Kozlov original http://blog.cloudflare.com/birthday-week-2023-wrap-up/

Birthday Week recap: everything we announced — plus an AI-powered opportunity for startups

Birthday Week recap: everything we announced — plus an AI-powered opportunity for startups

This year, Cloudflare officially became a teenager, turning 13 years old. We celebrated this milestone with a series of announcements that benefit both our customers and the Internet community.

From developing applications in the age of AI to securing against the most advanced attacks that are yet to come, Cloudflare is proud to provide the tools that help our customers stay one step ahead.

We hope you’ve had a great time following along and for anyone looking for a recap of everything we launched this week, here it is:

Monday

What

In a sentence…

Switching to Cloudflare can cut emissions by up to 96%

Switching enterprise network services from on-prem to Cloudflare can cut related carbon emissions by up to 96%. 

Cloudflare Trace

Use Cloudflare Trace to see which rules and settings are invoked when an HTTP request for your site goes through our network. 

Cloudflare Fonts

Introducing Cloudflare Fonts. Enhance privacy and performance for websites using Google Fonts by loading fonts directly from the Cloudflare network. 

How Cloudflare intelligently routes traffic

Technical deep dive that explains how Cloudflare uses machine learning to intelligently route traffic through our vast network. 

Low Latency Live Streaming

Cloudflare Stream’s LL-HLS support is now in open beta. You can deliver video to your audience faster, reducing the latency a viewer may experience on their player to as little as 3 seconds. 

Account permissions for all

Cloudflare account permissions are now available to all customers, not just Enterprise. In addition, we’ll show you how you can use them and best practices. 

Incident Alerts

Customers can subscribe to Cloudflare Incident Alerts and choose when to get notified based on affected products and level of impact. 

Tuesday

What

In a sentence…

Welcome to the connectivity cloud

Cloudflare is the world’s first connectivity cloud — the modern way to connect and protect your cloud, networks, applications and users. 

Amazon’s $2bn IPv4 tax — and how you can avoid paying it 

Amazon will begin taxing their customers $43 for IPv4 addresses, so Cloudflare will give those \$43 back in the form of credits to bypass that tax. 

Sippy

Minimize egress fees by using Sippy to incrementally migrate your data from AWS to R2. 

Cloudflare Images

All Image Resizing features will be available under Cloudflare Images and we’re simplifying pricing to make it more predictable and reliable.  

Traffic anomalies and notifications with Cloudflare Radar

Cloudflare Radar will be publishing anomalous traffic events for countries and Autonomous Systems (ASes).

Detecting Internet outages

Deep dive into how Cloudflare detects Internet outages, the challenges that come with it, and our approach to overcome these problems. 

Wednesday

What

In a sentence…

The best place on Region: Earth for inference

Now available: Workers AI, a serverless GPU cloud for AI, Vectorize so you can build your own vector databases, and AI Gateway to help manage costs and observability of your AI applications. 

Cloudflare delivers the best infrastructure for next-gen AI applications, supported by partnerships with NVIDIA, Microsoft, Hugging Face, Databricks, and Meta.

Workers AI 

Launching Workers AI — AI inference as a service platform, empowering developers to run AI models with just a few lines of code, all powered by our global network of GPUs. 

Partnering with Hugging Face 

Cloudflare is partnering with Hugging Face to make AI models more accessible and affordable to users. 

Vectorize

Cloudflare’s vector database, designed to allow engineers to build full-stack, AI-powered applications entirely on Cloudflare's global network — available in Beta. 

AI Gateway

AI Gateway helps developers have greater control and visibility in their AI apps, so that you can focus on building without worrying about observability, reliability, and scaling. AI Gateway handles the things that nearly all AI applications need, saving you engineering time so you can focus on what you're building.

 

You can now use WebGPU in Cloudflare Workers

Developers can now use WebGPU in Cloudflare Workers. Learn more about why WebGPUs are important, why we’re offering them to customers, and what’s next. 

What AI companies are building with Cloudflare

Many AI companies are using Cloudflare to build next generation applications. Learn more about what they’re building and how Cloudflare is helping them on their journey. 

Writing poems using LLama 2 on Workers AI

Want to write a poem using AI? Learn how to run your own AI chatbot in 14 lines of code, running on Cloudflare’s global network. 

Thursday

What

In a sentence…

Hyperdrive

Cloudflare launches a new product, Hyperdrive, that makes existing regional databases much faster by dramatically speeding up queries that are made from Cloudflare Workers.

D1 Open Beta

D1 is now in open beta, and the theme is “scale”: with higher per-database storage limits and the ability to create more databases, we’re unlocking the ability for developers to build production-scale applications on D1.

Pages Build Caching

Build cache is a feature designed to reduce your build times by caching and reusing previously computed project components — now available in Beta. 

Running serverless Puppeteer with Workers and Durable Objects

Introducing the Browser Rendering API, which enables developers to utilize the Puppeteer browser automation library within Workers, eliminating the need for serverless browser automation system setup and maintenance

Cloudflare partners with Microsoft to power their Edge Secure Network

We partnered with Microsoft Edge to provide a fast and secure VPN, right in the browser. Users don’t have to install anything new or understand complex concepts to get the latest in network-level privacy: Edge Secure Network VPN is available on the latest consumer version of Microsoft Edge in most markets, and automatically comes with 5GB of data. 

Re-introducing the Cloudflare Workers playground

We are revamping the playground that demonstrates the power of Workers, along with new development tooling, and the ability to share your playground code and deploy instantly to Cloudflare’s global network

Cloudflare integrations marketplace expands

Introducing the newest additions to Cloudflare’s Integration Marketplace. Now available: Sentry, Momento and Turso. 

A Socket API that works across Javascript runtimes — announcing WinterCG spec and polyfill for connect()

Engineers from Cloudflare and Vercel have published a draft specification of the connect() sockets API for review by the community, along with a Node.js compatible polyfill for the connect() API that developers can start using.

New Workers pricing

Announcing new pricing for Cloudflare Workers, where you are billed based on CPU time, and never for the idle time that your Worker spends waiting on network requests and other I/O.

Friday

What

In a sentence…

Post Quantum Cryptography goes GA 

Cloudflare is rolling out post-quantum cryptography support to customers, services, and internal systems to proactively protect against advanced attacks. 

Encrypted Client Hello

Announcing a contribution that helps improve privacy for everyone on the Internet. Encrypted Client Hello, a new standard that prevents networks from snooping on which websites a user is visiting, is now available on all Cloudflare plans. 

Email Retro Scan 

Cloudflare customers can now scan messages within their Office 365 Inboxes for threats. The Retro Scan will let you look back seven days to see what threats your current email security tool has missed. 

Turnstile is Generally Available

Turnstile, Cloudflare’s CAPTCHA replacement, is now generally available and available for free to everyone and includes unlimited use. 

AI crawler bots

Any Cloudflare user, on any plan, can choose specific categories of bots that they want to allow or block, including AI crawlers. We are also recommending a new standard to robots.txt that will make it easier for websites to clearly direct how AI bots can and can’t crawl.

Detecting zero-days before zero-day

Deep dive into Cloudflare’s approach and ongoing research into detecting novel web attack vectors in our WAF before they are seen by a security researcher. 

Privacy Preserving Metrics

Deep dive into the fundamental concepts behind the Distributed Aggregation Protocol (DAP) protocol with examples on how we’ve implemented it into Daphne, our open source aggregator server. 

Post-quantum cryptography to origin

We are rolling out post-quantum cryptography support for outbound connections to origins and Cloudflare Workers fetch() calls. Learn more about what we enabled, how we rolled it out in a safe manner, and how you can add support to your origin server today. 

Network performance update

Cloudflare’s updated benchmark results regarding network performance plus a dive into the tools and processes that we use to monitor and improve our network performance. 

One More Thing

Birthday Week recap: everything we announced — plus an AI-powered opportunity for startups

When Cloudflare turned 12 last year, we announced the Workers Launchpad Funding Program – you can think of it like a startup accelerator program for companies building on Cloudlare’s Developer Platform, with no restrictions on your size, stage, or geography.

A refresher on how the Launchpad works: Each quarter, we admit a group of startups who then get access to a wide range of technical advice, mentorship, and fundraising opportunities. That includes our Founders Bootcamp, Open Office Hours with our Solution Architects, and Demo Day. Those who are ready to fundraise will also be connected to our community of 40+ leading global Venture Capital firms.

In exchange, we just ask for your honest feedback. We want to know what works, what doesn’t and what you need us to build for you. We don’t ask for a stake in your company, and we don’t ask you to pay to be a part of the program.


Over the past year, we’ve received applications from nearly 60 different countries. We’ve had a chance to work closely with 50 amazing early and growth-stage startups admitted into the first two cohorts, and have grown our VC partner community to 40+ firms and more than $2 billion in potential investments in startups building on Cloudflare.

Next up: Cohort #3! Between recently wrapping up Cohort #2 (check out their Demo Day!), celebrating the Launchpad’s 1st birthday, and the heaps of announcements we made last week, we thought that everyone could use a little extra time to catch up on all the news – which is why we are extending the deadline for Cohort #3 a few weeks to October 13, 2023. AND we’re reserving 5 spots in the class for those who are already using any of last Wednesday’s AI announcements. Just be sure to mention what you’re using in your application.

So once you’ve had a chance to check out the announcements and pour yourself a cup of coffee, check out the Workers Launchpad. Applying is a breeze — you’ll be done long before your coffee gets cold.

Until next time

That’s all for Birthday Week 2023. We hope you enjoyed the ride, and we’ll see you at our next innovation week!


Récapitulatif de la Semaine anniversaire : tout ce que nous avons annoncé, ainsi qu'une opportunité fondée sur l'IA et dédiée aux start-ups

Post Syndicated from Dina Kozlov original http://blog.cloudflare.com/fr-fr/birthday-week-2023-wrap-up-fr-fr/


Birthday Week recap: everything we announced — plus an AI-powered opportunity for startups

Cette année, Cloudflare est officiellement entrée dans l’adolescence, puisque l’entreprise a fêté ses 13 ans. Nous avons fêté cet événement avec une série d’annonces qui profitent à la fois à nos clients et à la communauté Internet.

Du développement d’applications à l’ère de l’IA à la sécurisation contre des attaques extrêmement avancées et encore inconnues, Cloudflare est fière de fournir des outils qui aident nos clients à garder une longueur d’avance.

Nous espérons que vous avez passé un excellent moment à suivre notre actualité, et pour tous ceux qui souhaiteraient pouvoir consulter un récapitulatif de toutes les innovations que nous avons inaugurées cette semaine, le voici :

Lundi

Quoi

En quelques mots…

L’adoption de Cloudflare peut réduire jusqu’à 96 % les émissions de carbone

La migration des services de réseau d’entreprise équipements locaux vers les services de Cloudflare peut permettre de réduire de jusqu’à 96 % les émissions de carbone correspondantes. 

Cloudflare Trace

Utilisez Cloudflare Trace pour découvrir quels paramètres et règles sont invoqués lorsqu’une requête HTTP pour votre site transite sur notre réseau. 

Cloudflare Fonts

Découvrez Cloudflare Fonts. Améliorez la confidentialité et les performances des sites web utilisant Google Fonts en chargeant les polices de caractères directement depuis le réseau Cloudflare. 

Comment Cloudflare achemine intelligemment le trafic

Une analyse technique approfondie qui explique comment Cloudflare utilise l’apprentissage automatique pour acheminer intelligemment le trafic sur notre vaste réseau. 

Diffusion en direct à faible latence

La prise en charge de LL-HLS par Cloudflare Stream est désormais en version bêta ouverte. Vous pouvez diffuser des vidéos à votre public plus rapidement, en réduisant à 3 secondes seulement la latence que peut ressentir un spectateur dans son lecteur. 

Autorisations de compte pour tous

Les autorisations de compte Cloudflare sont désormais disponibles pour tous les clients, et non plus seulement pour les clients Enterprise. De plus, nous vous montrerons comment les utiliser et quelles sont les bonnes pratiques à adopter. 

Alertes sur les incidents

Les clients peuvent s’abonner aux alertes sur les incidents de Cloudflare et choisir à quel moment ils recevront une notification, en fonction des produits affectés et de l’importance de l’impact. 

Mardi

Quoi

En quelques mots…

Bienvenue dans la connectivité cloud

Cloudflare est la première solution de connectivité cloud du monde : l’approche moderne pour connecter et protéger votre cloud, vos réseaux, vos applications et vos utilisateurs 

La taxe à 2 milliards de dollars sur IPv4 d’Amazon – et comment vous pouvez éviter de la payer

Amazon va commencer à facturer à ses clients un montant de 43 dollars pour l’utilisation d’adresses IPv4. Cloudflare restituera donc ces 43 dollars sous forme de crédit, afin de contourner cette taxe. 

Sippy

Avec Sippy, minimisez les frais de trafic sortant lorsque vous effectuez la migration progressive de vos données d’AWS vers R2. 

Cloudflare Images

Toutes les fonctionnalités de redimensionnement d’images seront disponibles sous Cloudflare Images, et nous simplifions la tarification afin de la rendre plus prévisible et plus fiable.  

Anomalies du trafic et notifications avec Cloudflare Radar

Cloudflare Radar publiera les événements relatifs aux anomalies du trafic pour les pays et les systèmes autonomes (AS).

Détecter les pannes d’Internet

Découvrez comment Cloudflare détecte les pannes d’Internet, les défis qui en résultent, ainsi que notre approche pour surmonter ces problèmes. 

Mercredi

Quoi

En quelques mots…

Le meilleur endroit de la région : Terre pour l’inférence

Disponible maintenant : Workers AI, un cloud de processeurs graphiques serverless dédié à l’IA ; Vectorize, pour vous permettre de développer vos propres bases de données vectorielles ; et AI Gateway, pour simplifier la gestion des coûts et l’observabilité de vos applications basées sur l’IA. 

Cloudflare fournit la meilleure infrastructure pour les applications basées sur l’IA de nouvelle génération, soutenue par des partenariats avec NVIDIA, Microsoft, Hugging Face, Databricks et Meta.

Workers AI 

Lancement de Workers AI – Nous sommes ravis d’inaugurer Workers AI, une plateforme d’inférence IA en tant que service permettant aux développeurs d’exécuter des modèles d’IA avec seulement quelques lignes de code, reposant sur notre réseau mondial de processeurs graphiques. 

Partenariat avec Hugging Face 

Cloudflare annonce un partenariat avec Hugging Face, afin de rendre les modèles d’IA plus accessibles et plus abordables pour les utilisateurs. 

Vectorize

La base de données vectorielle de Cloudflare, conçue pour vous permettre aux ingénieurs de développer des applications full-stack, basées sur l’IA, entièrement sur le réseau mondial de Cloudflare – désormais disponible en version bêta ! 

AI Gateway

AI Gateway aide les développeurs à bénéficier d’un meilleur contrôle et une meilleure visibilité sur leurs applications IA, vous permettant de vous concentrer sur le développement sans vous préoccuper de l’observabilité, de la fiabilité et de l’évolutivité.AI Gateway gère tous les aspects nécessaires à la quasi-totalité des applications d’IA, vous permettant ainsi d’économiser le temps consacré au développement afin de vous concentrer sur ce que vous créez.

 

Vous pouvez maintenant utiliser WebGPU dans Cloudflare Workers

Les développeurs peuvent désormais utiliser WebGPU dans Cloudflare Workers. Découvrez pourquoi les WebGPU sont importants, pourquoi nous les proposons à nos clients et quelles sont les prochaines étapes. 

Ce que créent les entreprises spécialistes de l’IA avec Cloudflare

De nombreuses entreprises de développement d’IA utilisent Cloudflare pour créer des applications de nouvelle génération. Découvrez ce qu’ils développent et comment Cloudflare les aide dans leur démarche. 

Écrire des poèmes avec Llama 2 dans Workers AI

Vous voulez utiliser l’IA pour écrire un poème ? Apprenez à créer votre propre chatbot IA en 14 lignes de code et à l’exécuter sur le réseau mondial de Cloudflare. 

Jeudi

Quoi

En quelques mots…

Hyperdrive

Cloudflare lance un nouveau produit, Hyperdrive, qui rend les bases de données régionales existantes beaucoup plus rapides en accélérant considérablement les requêtes effectuées depuis Cloudflare Workers.

Bêta ouverte de D1

D1 est désormais disponible en version bêta ouverte, et le thème de cette version est « l’étendue » : avec des limites de stockage par base de données plus élevées et la possibilité de créer un plus grand nombre de bases de données, nous libérons la capacité des développeurs à créer, dans D1, des applications à la mesure des environnements de production.

Pages Build Caching

Ce service de mise en cache des versions est une fonctionnalité conçue pour réduire les délais de développement, grâce à la mise en cache et la réutilisation des composants de projet précédemment calculés – désormais disponible en version bêta. 

Exécuter Serverless Puppeteer avec Workers et Durable Objects

Découvrez l’API Browser Rendering, qui permet aux développeurs d’utiliser Puppeteer, la bibliothèque de tâches d’automatisation du navigateur, dans Workers, éliminant ainsi le besoin de configuration et de maintenance d’un système d’automatisation serverless du navigateur.

Cloudflare conclut un partenariat avec Microsoft pour exécuter sa solution Edge Secure Network

Nous avons conclu un partenariat avec Microsoft Edge afin de proposer un VPN rapide et sécurisé, directement dans le navigateur. Les utilisateurs n’ont pas besoin d’installer de nouvelles applications, ni de comprendre des concepts complexes pour bénéficier des dernières avancées en matière de confidentialité au niveau du réseau : le VPN Edge Secure Network est disponible dans la dernière version grand public de Microsoft Edge, sur la plupart des marchés, et est automatiquement fourni avec 5 Go de données. 

Redécouvrez le bac à sable Cloudflare Workers Playground

Nous sommes en train de refondre le bac à sable qui démontre la puissance de Workers, tout en proposant de nouveaux outils de développement, ainsi que la possibilité de partager le code de votre bac à sable et de le déployer instantanément sur le réseau mondial de Cloudflare.

La marketplace d’intégrations de Cloudflare se développe

Découvrez les nouveaux ajouts à la plateforme Integrations Marketplace de Cloudflare. Désormais disponibles : Sentry, Momento et Turso. 

Une API Socket qui s’exécute sur l’ensemble des runtimes JavaScript – annonce d’une spécification WinterCG et d’un polyfill pour connect()

Les ingénieurs de Cloudflare et Vercel ont publié un projet de spécification de l’API Sockets connect(), afin qu’elle soit examinée par la communauté, ainsi qu’un polyfill compatible avec Node.js pour l’API connect(), que les développeurs peuvent commencer à utiliser.

Nouvelle tarification de Workers

Annonce d’une nouvelle tarification pour Cloudflare Workers : la facturation sera établie en fonction du temps de processeur, et le temps d’inactivité pendant lequel votre instance Workers attend des requêtes réseau et d’autres E/S ne sera jamais facturé.

Vendredi

Quoi

En quelques mots…

La cryptographie post-quantique passe en disponibilité générale

Cloudflare déploie la prise en charge de la cryptographie post-quantique pour les clients, les services et les systèmes internes, afin d’assurer une protection proactive contre les attaques avancées. 

Encrypted Client Hello

Annonce d’une contribution qui aidera à améliorer la confidentialité pour tous les utilisateurs d’Internet. Encrypted Client Hello, une nouvelle norme qui empêche les réseaux d’espionner les sites web consultés par un utilisateur, est désormais disponible dans toutes les offres Cloudflare. 

Email Retro Scan 

Les clients de Cloudflare peuvent désormais analyser les messages de leurs boîtes de réception Office 365 afin de rechercher d’éventuelles menaces. Le service Retro Scan vous permet de revenir sept jours en arrière, afin d’identifier les menaces qui n’ont pas été détectées par votre outil de sécurité actuel. 

Turnstile est proposé en disponibilité générale

Turnstile, le remplaçant du CAPTCHA de Cloudflare, est maintenant disponible gratuitement pour tous et inclut une utilisation illimitée. 

Bots d’indexation IA

Quelle que soit l’offre souscrite, tout utilisateur de Cloudflare peut choisir des catégories spécifiques de bots qu’il souhaite autoriser ou bloquer, notamment les bots d’indexation. Nous recommandons également une nouvelle norme pour le fichier robots.txt, qui permettra aux sites web d’indiquer plus facilement et clairement les contenus que les bots IA sont ou non autorisés à indexer.

Détecter les menaces zero-day avant le jour zéro

Découvrez dans le détail l’approche et les recherches en cours de Cloudflare visant à détecter les nouveaux vecteurs d’attaque web dans notre pare-feu WAF avant qu’ils ne soient identifiés par un chercheur spécialiste de la sécurité. 

Indicateurs préservant la confidentialité

Consultez une analyse approfondie des concepts fondamentaux du protocole DAP (Distributed Aggregation Protocol), avec des exemples de son implémentation dans Daphne, notre serveur d’agrégation open source. 

Cryptographie post-quantique pour les connexions aux serveurs d’origine

Nous déployons actuellement la cryptographie post-quantique pour les connexions sortantes vers les serveurs d’origine et les appels fetch() à Cloudflare Workers. Apprenez-en davantage sur ce que nous avons mis en œuvre, comment nous avons sécurisé le déploiement et comment vous pouvez dès aujourd’hui ajouter la prise en charge à votre serveur d’origine. 

Mise à jour concernant les performances réseau

Consultez les résultats des indicateurs de référence actualisés de Cloudflare concernant les performances du réseau, ainsi qu’une analyse approfondie des outils et processus que nous utilisons pour surveiller et améliorer les performances de notre réseau. 

Encore une chose

Lorsque Cloudflare a fêté son douzième anniversaire l’année dernière, nous avons annoncé le programme de financement Workers Launchpad, que l’on peut considérer comme un programme d’accélération de start-ups dédié aux entreprises qui créent des solutions sur la plateforme de développement de Cloudlare, sans restriction de taille, de phase ou de secteur géographique.

Un rappel concernant le fonctionnement de Launchpad : chaque trimestre, nous acceptons un groupe de jeunes entreprises qui bénéficient ensuite d’un accès à un large éventail de conseils techniques, d’offres de mentorat et d’opportunités de collecte de fonds, parmi lesquelles les initiatives Founders Bootcamp, Open Office Hours avec nos spécialistes Solution Architect et Demo Day. Les entreprises prêtes à effectuer une levée des fonds seront également mises en contact avec notre communauté de plus de 40 éminentes sociétés de capital-risque, dans le monde entier.

Tout ce que nous vous demandons, en échange, c’est simplement de nous faire part de vos commentaires, en toute honnêteté. Nous voulons savoir ce qui fonctionne, ce qui ne fonctionne pas et ce que vous souhaitez nous demander de développer. Nous ne demandons aucune participation dans votre entreprise, et la participation au programme n’est pas payante.


Au cours de l’année passée, nous avons reçu des candidatures provenant de près de 60 pays. Nous avons eu l’opportunité de collaborer avec 50 incroyables start-ups en phase de lancement ou de croissance, qui ont été admises dans les deux premières promotions ; nous avons également étendu notre communauté de partenaires de capital-risque à plus de 40 sociétés, avec plus de 2 milliards de dollars d’investissements potentiels dans des start-ups développant des applications avec Cloudflare.

Prochainement : promotion no. 3 ! Entre la conclusion de la promotion no. 2 (allez voir l’événement Demo Day correspondant !), la célébration du premier anniversaire de l’initiative Launchpad et les nombreuses annonces que nous avons effectuées la semaine dernière, nous avons pensé chacun aurait besoin d’un peu plus de temps pour faire le point sur toute l’actualité – c’est pourquoi nous prolongeons de quelques semaines la date limite de la promotion no. 3, jusqu’au 13 octobre 2023. De plus, nous réservons 5 places dans le groupe pour les entreprises qui utilisent déjà l’une des innovations IA annoncées mercredi dernier. N’oubliez pas d’indiquer, dans votre candidature, le produit que vous utilisez.

Alors, lorsque vous aurez trouvé le temps de consulter les annonces et de vous servir un café, venez découvrir l’initiative Workers Launchpad. Déposer votre candidature est un jeu d’enfant – vous aurez terminé bien avant que votre café n’ait eu le temps de refroidir !

À la prochaine !

C’est tout pour la Semaine anniversaire 2023 Nous espérons que vous avez passé un bon moment, et nous vous donnons rendez-vous lors de notre future Innovation Week !


バースデーウィークの総括:当社のすべての発表、そしておよびスタートアップ企業にとってのAI活用の機会

Post Syndicated from Dina Kozlov original http://blog.cloudflare.com/ja-jp/birthday-week-2023-wrap-up-ja-jp/


Birthday Week recap: everything we announced — plus an AI-powered opportunity for startups

今年、Cloudflareは正式にティーンエイジャーとなり、13歳を迎えました。当社ではこの節目を、お客様とインターネットコミュニティの双方に有益な一連の発表で祝いました。

AI時代のアプリケーション開発から、これから起こる最先端の攻撃に対するセキュリティまで、Cloudflareはお客様が一歩先を行くためのツールを提供できることを誇りに思っています。

当社が今週発表したすべてのニュースをまとめてご紹介します:

月曜日

対象

一文で言えば…

Cloudflareへの切り替えにより、排出量を最大96%削減可能

企業ネットワークサービスをオンプレミスからCloudflareに切り替えることで、関連する二酸化炭素排出量を最大96%削減できます。 

Cloudflare Trace

Cloudflare Traceの使用により、お客様のサイトへのHTTPリクエストが当社のネットワークを通過する際、呼び出されるルールや設定を確認できます。 

Cloudflare Fonts

Cloudflare Fontsの概要紹介。Cloudflareネットワークから直接フォントを読み込むことで、Google Fontsを使用するWebサイトのプライバシーとパフォーマンスを強化します。 

Cloudflareがトラフィックをインテリジェントにルーティングする方法

Cloudflareによる、機械学習の利用を通した当社の広大なネットワークによりトラフィックをインテリジェントにルーティングする様子を説明する技術的な詳細解説。 

低遅延ライブストリーミング

Cloudflare StreamのLL-HLSサポート、オープンベータ版で公開されました。より高速な視聴者への動画配信で低遅延を実現し、視聴者の最長待機時間を最長3秒にまで抑えることができるようになりました。 

あらゆる人のためののアカウント権限

Cloudflareのアカウント権限が、法人のお客様だけでなくすべてのお客様にご利用いただけるようになりました。さらに、その使い方やベストプラクティスも紹介しています。 

インシデントアラート

Cloudflare Incident Alertsの受信申込により、影響を受ける製品と影響のレベルを基に通知を受けるタイミングを選択できるようになります。 

火曜日

対象

一文で言えば…

コネクティビティクラウドへようこそ

Cloudflareは世界初のコネクティビティクラウドで、クラウド、ネットワーク、アプリケーション、ユーザーを接続し保護する最新の方法となっています。 

AmazonによるIPv4への20億ドルの課金 — 支払いを回避する方法

AmazonはIPv4アドレスに対して顧客に$43の課金を開始します。Cloudflareは、この$43をクレジットとして還元し、課金を無効化します。 

Sippy

SippyによりAWSからR2へデータを段階的に移行することで、エグレス料金を最小限に抑えることができます。 

Cloudflare Images

すべての画像リサイズ機能がCloudflare Imagesで利用できるようになり、より予測可能で信頼性を高めるため価格設定を簡素化します。  

Cloudflare Radarによるトラフィックの異常および通知

Cloudflare Radarは、国と自律システム(AS)への異常なトラフィックイベントを公開します。

インターネット障害の検出

Cloudflareによるインターネット障害の検出方法、それに伴う課題、そしてこれらの問題を克服するためのアプローチについて深く掘り下げています。 

水曜日

対象

一文で言えば…

地域の最適な場所:地球上での推理

AI用サーバーレスGPUクラウド「Workers AI」、独自のベクターデータベースを構築できる「Vectorize」、AIアプリのコストと観測可能性の管理を支援する「AI Gateway」がご利用いただけるようになりました。 

Cloudflareは、NVIDIA、Microsoft、Hugging Face、Databricks、Metaとのパートナーシップに支えられ、次世代AIアプリのための最高のインフラストラクチャを提供しています。

Workers AI 

Workers AIの立ち上げ—グローバルなGPUネットワークの利用により、わずか数行のコードでAIモデルを実行できるAIインターフェース・アズ・ア・サービスプラットフォームとして、開発者を支えていきます。 

Hugging Faceとの提携 

CloudflareはHugging Faceと提携し、AIモデルをユーザーにとってより身近で手頃なものにします。 

Vectorize

Cloudflareのベクトルデータベースは、エンジニアがフルスタックのAI搭載アプリケーションを完全にCloudflareのグローバルネットワーク上で構築できるように設計されており、ベータ版としてご利用いただけます。 

AI Gateway

AI Gatewayを使用することで開発者はAIアプリの制御性と可視性を高めることができるため、観測性、信頼性、拡張性を心配することなく開発に集中することができます。AI Gatewayは、ほぼすべてのAIアプリケーションが必要とする処理を実行できるため、エンジニアリングの時間を節約し、開発に集中できるようになります。

 

Cloudflare WorkersでWebGPUが使用できるようになりました

Cloudflare Workersで開発者にWebGPUをご利用いただけるようになりました。WebGPUの重要性、当社が顧客にWebGPUを提供する理由、そして次なる開発予定の詳細をご覧ください。 

AI企業がCloudflareで何を構築しているか

多くのAI企業が次世代アプリケーションの構築にCloudflareを採用しています。当社のお客様が作り上げているもの、Cloudflareがお客様をサポートしている様子の詳細をご覧ください。 

Workers AIでLLama 2を使い、詩を書く

AIを使って詩を書いてみませんか?Cloudflareのグローバルネットワーク上で動作する、14行のコードでhp自身のAIチャットボットを実行する方法を学んでいただけます。 

木曜日

対象

一文で言えば…

Hyperdrive

Cloudflareは、Cloudflare Workersからのクエリを劇的に高速化することで、既存の各地域のデータベースを大幅に高速化する新製品Hyperdriveを発表しました。

D1オープンベータ

D1は現在オープンベータであり、そのテーマは「スケール」です:データベースごとのストレージ上限を引き上げ、より多くのデータベースを作成できるようになったことで、開発者はD1で本番規模のアプリケーションを構築できるようになります。

Pagesのビルドのキャッシング機能

ビルドのキャッシュは、以前に計算されたプロジェクト・コンポーネントをキャッシングして再利用することで、ビルド時間を短縮するように設計された機能です。 

WorkersとDurable ObjectsによるサーバーレスPuppeteerの実行

ブラウザレンダリングAPIにより、開発者はWorkers内でPuppeteerブラウザ自動化ライブラリを利用できるようになり、サーバーレスのブラウザ自動化システムのセットアップとメンテナンスが不要になります。その詳細を解説しています。

Cloudflare、マイクロソフトとの提携によりエッジセキュアネットワークを強化

当社はMicrosoft Edgeとの提携により、ブラウザ上で高速かつ安全なVPNを提供しています。最新のネットワーク・レベルPrivacy Edge セキュアネットワークVPNを利用するために新たに何かをインストールしたり、複雑な概念を理解したりする必要はありません。ほとんどの市場で、最新のコンシューマー版マイクロソフト・エッジで利用可能で、自動的に5GBのデータが付いてきます。 

Cloudflare Workers Playgroundの再度の紹介

新しい開発ツールや、プレイグラウンドのコードを共有してCloudflareのグローバルネットワークに即座にデプロイする機能とともに、Workersの持つ力が発揮される領域を刷新します。

Cloudflare Integration Marketplaceの拡大

CloudflareのIntegration Marketplaceに新しく追加されたものをご紹介しています。現在、Sentry、Momento、Tursoがご利用いただけます。 

JavaScriptランタイム全体で動作するSocket API — WinterCGの仕様とconnect()用のポリフィルを発表

CloudflareとVercel社のエンジニアが、開発者が今日からすぐに使い始められるconnect()のNode.js互換実装と、コミュニティでレビューするためのconnect()ソケットAPIの仕様を公開しました。

Workers新価格

CPU時間に基づく、そしてWorkerがネットワークリクエストとその他I/Oを待つアイドルタイムは一切除外した、当たらなCloudflare Workersのご請求モデルを発表します。

金曜日

対象

一文で言えば…

ポスト量子暗号が一般利用可能に

Cloudflareは、プロアクティブに高度な攻撃から保護するため、顧客、サービス、社内システムにポスト量子暗号のサポートを展開しています。 

Encrypted Client Hello

インターネット上のすべての人のプライバシーを向上させる製品の発表です。ネットワークによりユーザーがどのWebサイトを訪問しているかを盗み見られることを防ぐ新しい規格となるEncrypted Client Helloが、現在すべてのCloudflareプランでご利用いただけます。 

Email Retro Scan

Cloudflareのお客様は、Office 365の受信箱内のメッセージをスキャンして脅威を検出できるようになりました。Retro Scanでは、その時点でメールセキュリティツールが見逃している脅威を7日前にさかのぼり確認できます。 

Turnstileの一般利用開始

CloudflareのCAPTCHAの代替であるTurnstileは、現在無料で一般利用可能となっており、誰でも無制限に使用できます。 

AIクローラーボット

どのプランのCloudflareユーザーでも、AIクローラーを含め、許可またはブロックしたいボットの特定のカテゴリーを選択することができます。また、当社はAIボットによるクロールの可否をWebサイトが明確に指示できるようになるrobots.txtの新しい規格を推奨しています。

zero-dayより前にzero-dayを検出

セキュリティを研究する者によって特定される前に、当社のWAFで新しいWeb攻撃ベクトルを検出するためのCloudflareのアプローチ、そして現在進行中の研究を深く掘り下げます。 

プライバシー保護メトリクス

DAP(Distributed Aggregation Protocol、分散型集積プロトコル)の基本概念を、オープンソースのアグリゲーター・サーバーであるDaphneへの実装例を交えて深く掘り下げています。 

ポスト量子暗号をオリジンに適用

オリジンへのアウトバウンド接続とCloudflare Workersのfetch()呼び出しに対し、ポスト量子暗号による対応を始めます。当社が可能にしたこと、その安全な方法での展開方法、そして今すぐ貴社の配信元サーバーにサポートを追加する方法について、詳細をご覧ください。 

ネットワーク パフォーマンス更新

ネットワークパフォーマンスに関するCloudflareの最新のベンチマーク結果と、ネットワークパフォーマンスの監視と改善に使用しているツールやプロセスについてご紹介します。 

追加

Cloudflareが昨年12周年を迎えた折、Workers Launchpad Funding Programを発表しました。クラウドレアのデベロッパー・プラットフォーム上に構築する企業のためのスタートアップ加速プログラムのようなもので、企業の規模、ステージ、地域に制限はありません。

Launchpadの仕組みについての振り返り:四半期ごとに、私たちはスタートアップのグループを選出し、幅広い技術的アドバイス、指導、資金調達の機会を提供しています。これには、ファウンダーズ・ブートキャンプ、ソリューション・アーキテクトによるオープン・オフィス・アワー、デモ・デーなどが含まれます。また、資金調達の準備が整ったスタートアップは、40社以上のグローバルな大手ベンチャーキャピタルのコミュニティに参加することができます。

その代わり、率直な感想の提供を依頼しています。当社では、何がうまくいき、何がうまくいかず、何が必要なのかを知りたいのです。当社は、貴企業への出資者となることを求めることはなく、プログラムに参加するために費用を負担することも求めていません。


ここまで、60か国近くからの応募を受けてきました。当社は、最初の2つのコホートに参加した50の見事な初期および成長段階の新興企業と緊密に協力する機会を得、当社のVCパートナー・コミュニティを40社以上に拡大し、Cloudflareを基盤とする新興企業への潜在的な投資額は20億ドルを超えました。

次は、コホート#3となります。 先日、第2コホートが終了し(デモ・デーをぜひご覧ください)、Launchpadの1歳の誕生日を祝い、そして先週行ったたくさんの発表の間に、皆様にすべてのニュースにキャッチアップしていただくために十分な時間をとることが必要だと考えました。そのため、第3コホートの締め切りを数週間延長し、2023年10月13日とします。また、先週水曜日に発表されたAIのいずれかをすでに利用している方のために、5名分の枠を確保しています。応募時には、現在お使いいただいているものを明記していただけるよう、お願いいたします。

お知らせをチェックし、コーヒーを飲んで休んだら、Workers Launchpadをチェックしてみてください。応募は簡単です。コーヒーが冷めないうちに、応募は完了するでしょう。

次回まで

2023年のバースデーウィークは、以上です。また次回のイノベーション・ウィークでお会いしましょう!


창립기념일 주간 요약: Cloudflare에서 발표한 모든 내용 및 스타트업을 위한 AI를 기반으로 한 기회

Post Syndicated from Dina Kozlov original http://blog.cloudflare.com/ko-kr/birthday-week-2023-wrap-up-ko-kr/


Birthday Week recap: everything we announced — plus an AI-powered opportunity for startups

올해 Cloudflare에서는 공식적으로 13주년을 맞습니다. 우리는 이 이정표를 고객과 인터넷 커뮤니티 모두에 이점을 선사하는 다양한 발표로 기념했습니다.

AI 시대에 애플리케이션을 개발하는 것부터 아직 등장하지도 않은 최신 위협으로부터 보호하는 것까지 Cloudflare에서는 고객이 한 발자국 앞서 있을 수 있도록 도구를 제공한다는 사실을 자랑스럽게 여깁니다.

이러한 발표를 지켜보며 즐거운 시간이 되셨기를 바랍니다. 이번 주에 출시한 제품의 요약은 다음과 같습니다.

월요일

대상

한 문장으로 요약하면…

배출량을 최대 96% 줄일 수 있는 Cloudflare로의 전환

엔터프라이즈 네트워크 서비스를 온프레미스에서 Cloudflare로 전환하면 관련 탄소 배출량을 최대 96% 줄일 수 있습니다. 

Cloudflare Trace

Cloudflare Trace를 사용하여 여러분의 사이트를 위한 HTTP 요청이 당사 네트워크를 거칠 때 어떤 규칙과 설정이 호출되는지 확인하세요. 

Cloudflare Fonts

Cloudflare Fonts를 소개합니다. Cloudflare 네트워크에서 바로 글꼴을 로딩하여 Google Fonts를 사용해 웹 사이트의 개인정보 보호 및 성능을 개선합니다. 

Cloudflare에서 트래픽을 지능적으로 라우팅하는 방법

Cloudflare에서 머신 러닝을 사용하여 방대한 당사 네트워크를 통해 트래픽을 지능적으로 라우팅하는 방법을 설명하는 기술 심층 탐구입니다. 

대기 시간이 짧은 라이브 스트리밍

이제 Cloudflare Stream의 LL-HLS 지원이 오픈 베타로 제공됩니다. 잠재 고객에게 동영상을 더 빠르게 전달함으로써 플레이어에서 시청자의 대기 시간을 3초로 단축할 수 있습니다. 

모두를 위한 계정 권한

Cloudflare 계정 권한이 이제 Enterprise 고객만이 아니라 모든 고객에게 제공됩니다. 또한, 이를 사용하는 방법과 모범 사례를 보여드립니다. 

Incident Alerts

이제 고객은 Cloudflare Incident Alerts를 구독하고 피해를 입은 제품 및 피해의 심각도에 따라 알림을 받을 시기를 선택할 수 있습니다. 

화요일

대상

한 문장으로 요약하면…

클라우드 연결성에 오신 것을 환영합니다

Cloudflare는 세계 최초 클라우드 연결성으로 클라우드, 네트워크, 애플리케이션, 사용자를 연결하고 보호하기 위한 최신 방법입니다. 

Amazon의 20억 달러 규모의 IPv4 징수, 그리고 이를 피하는 방법 

Amazon에서는 IPv4 주소에 대해 43달러를 징수하기 시작할 예정입니다. 그렇기에 Cloudflare에서는 이러한 징수를 우회하기 위해 크레딧의 형태로 43달러를 돌려드릴 계획입니다. 

Sippy

Sippy를 사용해 송신료를 최소화하여 데이터를 AWS에서 R2로 점진적으로 마이그레이션하세요. 

Cloudflare Images

모든 Image Resizing 기능이 Cloudflare Images에서 제공될 예정이며 Cloudflare에서는 더 예측 가능하고 신뢰할 수 있도록 가격을 단순하게 책정하고 있습니다.  

트래픽 이상과 Cloudflare Radar 알림

Cloudflare Radar는 국가와 자율 시스템(ASes)을 위해 비정상적인 트래픽 이벤트를 게시할 것입니다.

인터넷 중단 감지

Cloudflare에서 인터넷 중단을 감지하는 방법, 이에 따른 과제, 이러한 문제를 극복하기 위한 접근법을 심층적으로 알아봅니다. 

수요일

대상

한 문장으로 요약하면…

리전에서 가장 좋은 장소: 추론을 위한 지구

AI를 위한 서버리스 GPU 클라우드인 Workers AI, 자체 벡터 데이터베이스를 구축하기 위한 Vectorize, AI 애플리케이션의 비용 및 관찰 가능성을 관리하기 위한 AI Gateway를 이제 제공합니다. 

Cloudflare에서는 차세대 AI 애플리케이션을 위한 최고의 인프라를 제공합니다. 이 인프라는 NVIDIA, Microsoft, Hugging Face, Databricks, Meta와 체결한 파트너십에 따라 지원됩니다.

Workers AI 

개발자가 단 몇 줄의 코드만으로 AI 모델을 실행할 수 있도록 지원하는 서비스형 AI 추론 플랫폼인 Workers AI를 출시하며 이는 Cloudflare의 GPU 전역 네트워크를 기반으로 합니다. 

Hugging Face와의 파트너십 

Cloudflare에서 Hugging Face와 파트너십을 체결함에 따라 사용자는 합리적인 가격에 AI 모델에 더 쉽게 액세스할 수 있게 되었습니다. 

Vectorize

베타로 제공되고 있는 이 Cloudflare의 벡터 데이터베이스는 엔지니어가 Cloudflare의 전역 네트워크에서만 전체 스택 AI 기반 애플리케이션을 구축할 수 있도록 설계되었습니다. 

AI Gateway

AI Gateway는 개발자가 AI 앱에 대한 제어 능력을 강화하고 가시성을 확보할 수 있도록 지원하므로 관찰 가능성, 안정성 및 확장에 대한 걱정 없이 빌드에만 집중할 수 있습니다. AI Gateway는 거의 모든 AI 앱에 필요한 것들을 처리하여 엔지니어링 시간을 절약할 수 있으므로 개발자는 빌드에 집중할 수 있도록 합니다.

 

이제 Cloudflare Workers에서 WebGPU를 사용할 수 있습니다

개발자는 이제 Cloudflare Workers에서 WebGPU를 사용할 수 있습니다. WebGPU가 중요한 이유, 이를 고객에게 제공하는 이유, 앞으로의 계획 등을 자세히 알아보세요. 

AI 회사에서 Cloudflare와 함께 구축한 사항 알아보기

많은 AI 회사에서는 Cloudflare를 이용하여 차세대 애플리케이션을 구축하고 있습니다. 구축하고 있는 제품과 Cloudflare가 이러한 여정에서 도움이 되는 방법을 자세히 알아보세요. 

Workers AI에서 LLama 2를 이용하여 시 창작

AI를 이용하여 시를 쓰고 싶으신가요? Cloudflare의 전역 네트워크에서 실행되는 14줄의 코드로 자체 AI 챗봇을 실행하는 방법을 알아보세요. 

목요일

대상

한 문장으로 요약하면…

Hyperdrive

Cloudflare에서는 Cloudflare Workers에서 만들어진 쿼리의 속도를 대폭 개선하여 기존의 지역 데이터베이스를 훨씬 더 빠르게 만드는 신제품 Hyperdrive를 출시합니다.

D1 오픈 베타

D1의 현재 베타 버전은 “확장”을 중심으로 합니다. 데이터베이스당 스토리지 한도를 늘리고 더 많은 데이터베이스를 생성할 수 있는 기능을 통해 개발자가 D1에서 프로덕션 규모의 응용 프로그램을 구축할 수 있도록 지원합니다.

Pages 빌드 캐싱

이제 베타로 제공되는 빌드 캐시는 이전에 처리된 프로젝트 구성 요소를 캐싱하고 재사용하여 빌드 시간을 단축하도록 설계된 기능입니다. 

Workers 및 Durable Objects로 서버리스 Puppeteer 실행

개발자가 서버리스 브라우저 자동화 시스템을 설정하거나 유지 관리하지 않고 Workers 내에서 Puppeteer 브라우저 자동화 라이브러리를 활용할 수 있게 하는 브라우저 렌더링 API를 소개합니다

Edge Secure Network를 지원하기 위해 Microsoft와 파트너십을 체결한 Cloudflare

Cloudflare에서는 Microsoft Edge와 파트너십을 체결하여 브라우저 내에서 빠르고 안전한 VPN을 제공합니다. 사용자는 네트워크 수준의 최신 개인정보 보호를 위해 새로운 프로그램을 설치하거나 복잡한 개념을 이해할 필요가 없습니다. Edge Secure Network VPN은 대부분의 시장에서의 최신 소비자 버전의 Microsoft Edge에서 사용할 수 있으며, 5GB의 데이터가 자동으로 제공됩니다. 

Cloudflare Workers Playground 다시 도입

Workers의 위력을 선보이는 플레이그라운드를 개선하고 새로운 개발 툴링 및 플레이그라운드 코드를 공유하며 즉각적으로 이를 Cloudflare의 전역 네트워크에 배포할 수 있는 기능을 개발하고 있습니다

Cloudflare 통합 마켓플레이스의 확대

Cloudflare의 통합 마켓플레이스에 가장 최근에 추가된 것을 소개합니다. 이제 Sentry, Momento, Turso를 제공합니다. 

Javascript 런타임 전반에서 작동하는 소켓 API — WinterCG 사양 및 connect()를 위한 폴리필 발표

Cloudflare와 Vercel의 엔지니어들은 커뮤니티에서 검토할 수 있도록 connect() 소켓 API의 초기 사양을 공개하고 아울러 개발자가 사용을 시작할 수 있도록 connect() API를 위한 Node.js와 호환 가능한 폴리필을 공개했습니다.

새로운 Workers 가격

여러분의 Worker가 네트워크 요청 및 기타 I/O를 기다리는 유휴 시간이 아닌 CPU 시간에 따라 요금이 청구되는 Cloudflare Workers에 대한 새로운 요금제를 발표합니다.

금요일

대상

한 문장으로 요약하면…

포스트 퀀텀 암호화, 일반 사용자도 이용 가능(GA) 

Cloudflare에서는 포스트 퀀텀 암호화 지원을 출시하여 고객, 서비스, 내부 시스템을 최신 공격으로부터 능동적으로 보호합니다. 

암호화된 Client Hello

모든 인터넷 사용자의 개인정보 보호를 강화하는 데 기여하는 제품을 발표합니다. 사용자가 방문하고 있는 웹 사이트를 누군가 염탐하지 못하도록 네트워크를 보호하는 새로운 기준인 암호화된 Client Hello가 이제 모든 Cloudflare 요금제에서 제공됩니다. 

이메일 Retro Scan 

Cloudflare 고객은 이제 Office 365 수신함의 메시지에서 위협을 스캔할 수 있습니다. Retro Scan은 7일 전까지의 메시지를 확인하여 현재 이메일 보안 도구에서 놓친 위협이 있는지 찾습니다. 

Turnstile, 일반 사용자도 이용 가능(GA)

Cloudflare의 캡차 대체품인 Turnstile이 이제 일반 사용자에게 제공되며 모든 사람이 무료로, 무제한으로 사용할 수 있습니다. 

AI 크롤러 봇

Cloudflare 사용자는 어떤 요금제를 사용하더라도 AI 크롤러를 포함하여 허용하거나 차단할 특정 봇 카테고리를 선택할 수 있습니다. Cloudflare에서는 웹 사이트에서 AI 봇이 크롤링할 수 있거나 없는 것을 더 쉽게 명시할 수 있게 하는 robots.txt에 대한 새로운 기준을 권장하고 있습니다.

제로 데이 이전에 제로 데이 탐지하기

보안 리서치 도구에서 식별하기 전에 WAF에서 심각한 웹 공격 벡터를 감지하는 Cloudflare의 접근법과 지속적인 연구를 심층적으로 알아봅니다. 

개인정보 보호 유지 메트릭

분산 집계 프로토콜(DAP)에 숨겨진 기본 개념과 더불어 Cloudflare에서 이를 당사 오픈 소스 애그리게이터 서버인 Daphne에 구현한 방법을 심층적으로 알아봅니다. 

원본에 대한 포스트 퀀텀 암호화

원본 및 Cloudflare Workers fetch() 호출에 대한 아웃바운드 연결을 위한 포스트 퀀텀 암호화 지원을 출시합니다. 활성화한 제품, 이를 안전한 방식으로 출시한 방법, 지금 원본 서버에 지원을 추가할 방법 등을 자세히 알아보세요. 

네트워크 성능 업데이트

네트워크 성능에 대한 Cloudflare의 업데이트된 벤치마크 결과와 네트워크 성능을 모니터링하고 개선하기 위해 사용하는 도구 및 프로세스를 심층적으로 알아봅니다. 

추가 내용

Cloudflare에서는 12주년을 맞이했을 때 Workers Launchpad 자금 조달 프로그램을 발표했습니다. 이는 규모, 단계, 지리와는 관계없이 Cloudflare의 개발자 플랫폼에서 구축하고 있는 회사를 위한 스타트업 지원 프로그램이라고 생각하시면 됩니다.

Launchpad가 어떻게 작동하는지 다시 간략하게 알려드리겠습니다. 분기마다 Cloudflare에서는 스타트업을 모집하여 다양한 기술 조언, 멘토링, 자금 조달 기회를 제공합니다. 이러한 기회로는 Cloudflare의 Founders 부트캠프, 솔루션 아키텍트와 함께하는 열린 업무 시간, 데모 데이 등이 있습니다. 자금을 조달할 준비가 된 스타트업은 40여 개의 선도적인 글로벌 벤처 캐피털 회사로 구성된 Cloudflare 커뮤니티와 만나게 됩니다.

이 모든 기회를 제공하는 대신 여러분의 솔직한 피드백만을 요청합니다. 도움이 된 부분, 도움이 되지 않은 부분, 여러분을 위해 구축해주었으면 하는 제품을 알려 주세요. Cloudflare에서는 귀사의 지분을 요구하지 않습니다. 프로그램 참여의 대가로 금전을 요구하지도 않습니다.


지난 몇 년간 60개에 가까운 국가로부터 신청서를 받았습니다. Cloudflare는 첫 2개의 그룹에 참여한 초기 단계와 성장 단계에 있는 50개의 엄청난 스타트업과 긴밀하게 협업할 기회가 있었습니다. 이를 통해 Cloudflare의 벤처 캐피털 파트너 커뮤니티에 40여 개의 회사가 참여하게 되었으며 Cloudflare에서 구축하는 스타트업에 잠재적으로 20억 달러 이상을 투자할 수 있게 되었습니다.

다음 계획: 그룹 #3! 최근 그룹 #2(이 그룹의 데모 데이를 확인해 보세요!)가 마무리되고, Launchpad 1주년을 기념하며, 지난주에 발표한 수많은 내용 사이에 모든 소식을 소화할 약간의 시간이 있으면 좋겠다고 생각했습니다. 그래서 그룹 #3의 기한을 몇 주 늦추어 2023년 10월 13일로 정했습니다. 그리고 다섯 자리를 지난 수요일의 AI 발표를 이미 사용하고 있는 스타트업을 위해 남겨두었습니다. 여러분의 애플리케이션에서 무엇을 사용하고 있는지 꼭 말씀해 주세요.

발표 내용을 확인하고 커피도 한 잔 마실 시간을 드렸습니다. Workers Launchpad를 확인해 보세요. 커피가 채 식기도 전에 쉽게 지원할 수 있습니다.

다음에 또 뵙겠습니다

이렇게 2023 창립기념일 주간이 끝났습니다. 즐거운 시간이 되셨기를 바라며 다음 혁신 주간에서 뵙겠습니다!


生日周回顾:我们宣布的所有内容,以及为初创企业提供的 AI 驱动机会

Post Syndicated from Dina Kozlov original http://blog.cloudflare.com/zh-cn/birthday-week-2023-wrap-up-zh-cn/


Birthday Week recap: everything we announced — plus an AI-powered opportunity for startups

今年,Cloudflare 正式成为踏入青春阶段,迎来了 13 岁生日。为了庆祝这个里程碑,我们发布了一系列公告,我们的客户和互联网社区都会从中受益。

从在人工智能时代开发应用,到防御尚未出现的最先进攻击,Cloudflare 很高兴能提供帮助我们的客户保持领先一步的工具。

我们希望您跟随我们度过了一段美好的时光,如果想要回顾我们本周发布的所有内容,请查看下文:

周一

目标

简介

改用 Cloudflare 可以减少高达 96% 的排放量

将企业网络服务从本地设备更换为 Cloudflare 服务可将相关碳排放减少多达 96%。 

Cloudflare Trace

使用 Cloudflare Trace 查看当站点 HTTP 请求通过我们的网络时调用了哪些规则和设置。 

Cloudflare Fonts

推出 Cloudflare Fonts。通过直接从 Cloudflare 网络加载字体,为使用 Google 字体的网站增强隐私保护和性能。 

Cloudflare 如何智能路由流量

深入解释 Cloudflare 如何利用机器学习智能路由流量通过我们庞大的网络。 

低延迟实时流

Cloudflare Stream 的 LL-HLS 支持现已推出测试版。您能够以更快的速度将视频传输给观众,将可能的播放延迟缩短至 3 秒。 

账户许可全面开放

原 Enterprise 专享的 Cloudflare 账户许可现已向所有客户开放。此外,我们将向您展示账户许可的使用方式及最佳实践。 

事件警报

客户现可订阅 Cloudflare 事件警报,选择何时收到基于受影响产品和影响程度的通知。 

周二

什么

简介

欢迎认识全球连通云

Cloudflare 是全球首款全球连通云——连接和保护云、网络、应用和用户的现代方式。 

Amazon 的 20 亿美元 IPv4 税费 — 以及如何避免支付这笔费用

Amazon 将开始对其客户征收 43 美元的 IPv4 地址费用,因此 Cloudflare 将以积分形式返还这 43 美元。 

Sippy

通过使用 Sippy 逐步将数据从 AWS 迁移到 R2,最大程度地减少出口费用。 

Cloudflare Images

所有图像调整大小功能将在 Cloudflare Images 下可用,我们正在简化定价以使其更可预测和可靠。  

使用 Cloudflare Radar 检测流量异常并发送通知

Cloudflare Radar 将发布有关国家和自治系统(AS)的异常流量事件。

检测互联网中断

深入探讨 Cloudflare 如何检测互联网中断、面临的挑战以及我们克服这些问题的方法。 

周三

目标

简介

区域最佳地点:推论地球

现已推出:Workers AI —— 用于 AI 的无服务器 GPU 云;Vectorize —— 用于构建自己的矢量数据库;以及 AI Gateway —— 帮助管理 AI 应用的成本和可观察性。 

通过与 NVIDIA、Microsoft、Hugging Face、Databricks 和 Meta 等的合作伙伴关系,Cloudflare 为下一代 AI 应用程序提供最佳的基础设施。

Workers AI 

隆重推出 Workers AI——AI 推理即服务平台,使开发人员只需几行代码即可运行 AI 模型,由我们的全球 GPU 网络提供支持。 

与 Hugging Face 携手合作 

Cloudflare 与 Hugging Face 合作,旨在使 AI 模型对用户更易使用和经济实惠。 

Vectorize

Vectorize 是 Cloudflare 新推出的矢量数据库产品,旨在让您完全在 Cloudflare 的全球网络上构建 AI 加持的全栈应用,现已提供测试版。 

AI Gateway

AI Gateway 使开发人员在他们的 AI 应用中拥有更好的控制力和可见性,能够专注构建,不用担心可观察性、可靠性和可扩展性。AI Gateway 可以处理几乎所有 AI 应用程序需要的内容,节省工程时间,使您专注构建内容。

 

您现在可以在 Cloudflare Workers 中使用 WebGPU

开发人员现在可在 Cloudflare Workers 中使用 WebGPU。进一步了解为什么 WebGPU 很重要,为什么我们向客户提供它们,以及接下来的计划。 

AI 公司使用 Cloudflare 构建的内容

很多 AI 公司正在使用 Cloudflare 来构建下一代应用。进一步了解他们正在构建什么应用,以及 Cloudflare 如何在这方面提供帮助。 

在 Workers AI 上使用 LLama 2 写诗

想用 AI 写诗吗?学习如何在 Cloudflare 的全球网络上用 14 行代码运行自己的 AI 聊天机器人。 

周四

目标

简介

Hyperdrive

Cloudflare 推出全新产品 Hyperdrive,显著加快 Cloudflare Workers 的查询速度,大幅提高了现有区域数据库的速度。

D1 开放测试

D1 现在处于公测阶段,主旋律是“规模”:每数据库的存储限制更高,并且能够创建更多数据库,我们正在解锁开发人员在 D1 上构建生产规模应用程序的能力。

Pages 构建缓存

构建缓存功能通过缓存并重复使用以前计算的项目组件来缩短构建时间。 

通过 Workers 和 Durable Objects 运行 Serverless Puppeteer

推出浏览器渲染 API,使开发人员能够在 Workers 中利用 Puppeteer 浏览器自动化库,消除了无服务器浏览器自动化系统设置和维护的需要。

Cloudflare 与 Microsoft 合作,为 Edge 安全网络提供支持

我们与 Microsoft Edge 合作在浏览器中提供一种快速、安全的 VPN。用户不需要安装任何新东西或理解复杂的概念,就能获得最新的网络级隐私:Edge 安全网络 VPN 在大多数市场上都可以在最新的 Microsoft Edge 消费者版本上使用,并自动附带 5 GB 数据。 

重新引入 Cloudflare Workers 操练场

我们正在改造展示 Workers 强大功能的操练场,并提供新的开发工具,还可以共享操练场代码并立即部署到 Cloudflare 全球网络。

Cloudflare 集成市场扩大

推出 Cloudflare 集成市场的新增项目。现已可用:Sentry、Momento 和 Turso。 

跨 JavaScript 运行时工作的 Socket API——发布 WinterCG 规范和 polyfill for connect()

Cloudflare 和 Vercel 的工程师已经发布了 connect() 套接字 API 的规范草案,供社区审查,同时还发布了一个兼容 Node.js 的 polyfill for connect() API,供开发人员开始使用。

Workers 新定价方案

宣布推出全新 Cloudflare Workers 定价方案,按 CPU 时间计费,绝不对 Worker 用于等待网络请求和其他 I/O 的空闲时间计费。

周五

目标

简介

后量子加密正式发布 

Cloudflare 推出对客户、服务和内部系统的后量子加密支持,以主动防御高级攻击。 

Encrypted Client Hello

宣布为改善互联网每个人的隐私而做出贡献。Encrypted Client Hello 是一项新标准,可防止网络窥探用户访问什么网站,现已提供给所有 Cloudflare 计划使用。 

Email Retro Scan 

Cloudflare 客户现在可以扫描其 Office 365 收件箱中的消息以寻找威胁。Retro Scan 功能可以让您回溯七天,检查当前电子邮件安全工具所漏检的威胁。 

Turnstile 现已正式发布

Turnstile,Cloudflare 的验证码替代方案,现已正式发布,免费提供给所有人无限使用。 

AI 爬虫机器人

任何 Cloudflare 用户,无论使用什么计划,都可以选择他们想要允许或阻止的特定类别机器人,包括 AI 爬虫。我们还推荐了一个 robots.txt 的新标准,可让网站更易清晰指示 AI 机器人的可爬行范围。

检测 zero-day 攻击并避免受害

深入剖析 Cloudflare 在 WAF 早于安全研究人员检测出新型网络攻击手段的方式和进行中的研究。 

保护隐私的指标

深入介绍分布式聚合协议(DAP)协议背后的基本概念,并通过示例说明我们如何将其实现到我们的开源聚合服务器 Daphne 中。 

到源服务器的后量子加密

推出后量子加密,支持到源服务器和 Cloudflare Workers fetch() 调用的出站连接。详细了解我们支持什么,如何以安全的方式推出,以及您今天如何为自己的源服务器添加支持。 

网络性能更新

Cloudflare 网络性能基准测试结果更新,并深入介绍我们用于监测和改进网络性能的工具和流程。 

还有一件事

去年,在 Cloudflare 成立 12 周年之际,我们宣布推出 Workers Launchpad 资助计划。您可以将其视为向 Cloudflare 开发者平台上构建的公司提供的创业加速计划,没有规模、阶段或地理位置的限制。

回顾一下 Launchpad 的运作方式: 每个季度,我们接纳一批初创企业,他们将获得广泛的技术建议、指导和募资机会。其中包括我们的创始人训练营、与我们的解决方案架构师一起的开放办公时间以及演示日。做好募资准备的企业还将与我们拥有 40 多家全球领先风险投资公司的社区建立联系。

作为交换,我们仅希望得到您真诚的反馈。我们希望了解哪些有效工作,哪些无效,以及您需要我们为您构建什么。我们不要求获得您公司的股份,也不要求您支付费用来参与计划。


在过去的一年里,我们收到来自近 60 个不同国家的申请。我们有机会与前两批 50 家优秀的早期和成长期初创企业密切合作,而且我们的风险投资合作伙伴社区已经发展到 40 多家公司,对在 Cloudflare 上构建的初创企业进行的潜在投资规模超过 20 亿美元。

下一步:第三批! 鉴于第二批最近才结束 (查看他们的演示日), 庆祝 Launchpad 计划一周年,而且我们上周发布了一系列公告, 我们认为大家需要多一点时间来了解所有的新闻,因此我们将第三批的截止期限延长几周到 2023 年 10 月 13 日。我们还将本批的 5 个名额预留给已经使用上周三宣布的任何 AI 产品的公司。记得在申请中说明你正在使用的产品。

如果您有空查看以上公告,不妨了解一下 Workers Launchpad。申请非常简单快捷,只要一杯茶的时间。

下次再会

以上就是 2023 年生日周的全部内容。希望您喜欢以上精彩内容,并期待在下一个创新周再见!


Die Birthday Week im Rückblick: alle unsere Ankündigungen und eine KI-gestützte Chance für Start-ups

Post Syndicated from Dina Kozlov original http://blog.cloudflare.com/de-de/birthday-week-2023-wrap-up-de-de/


Birthday Week recap: everything we announced — plus an AI-powered opportunity for startups

Dieses Jahr ist Cloudflare offiziell ins Teenager-Alter eingetreten, denn wir feiern unser 13-jähriges Firmenjubiläum. Anlässlich dieses Meilensteins haben wir eine Reihe von neuen Produkten vorgestellt, von denen sowohl unseren Kunden als auch die Internet-Community im Allgemeinen profitieren werden.

Von der Anwendungsentwicklung im Zeitalter der KI bis hin zum Schutz vor den ausgefeiltesten Angriffen, die noch erdacht werden müssen: Mit den Werkzeugen von Cloudflare sind unsere Kunden dem Geschehen immer einen Schritt voraus.

Wir hoffen, dass unsere Ankündigungen für Sie von Interesse waren. Sollten Sie befürchten, etwas verpasst zu haben, finden Sie hier noch einmal ein Überblick über alles, was wir während der Birthday Week eingeführt haben:

Montag

Neuerung

Das Wichtigste in Kürze

Ein Wechsel zu Cloudflare ermöglicht Emissionseinsparungen von bis zu 96 %

Durch die Verlagerung der von Unternehmen benötigten Netzwerkdienste von lokalen Geräten auf Cloudflare lassen sich die mit diesen Services verbundenen Emissionen um bis zu 96 % reduzieren. 

Cloudflare Trace

Mit Cloudflare Trace können Sie sehen, welche Regeln und Einstellungen zum Tragen kommen, wenn eine HTTP-Anfrage an Ihre Website unser Netzwerk durchläuft. 

Cloudflare Fonts

Wir präsentieren Cloudflare Fonts. Indem Sie Schriftarten direkt aus dem Cloudflare-Netzwerk laden, können Sie Datenschutz und Performance bei Websites verbessern, die Google Fonts verwenden. 

Smartes Routen von Traffic mit Cloudflare

Eine gründliche technische Analyse dazu, wie wir mithilfe von maschinellem Lernen Traffic auf smarte Weise durch unser großes Netzwerk leiten. 

Latenzarmes Livestreaming

Die LL-HLS-Unterstützung bei Cloudflare Stream ist jetzt in der Open Beta-Version verfügbar. Sie können Ihrem Publikum Videos schneller bereitstellen und die auf dem Player eventuell wahrgenommene Latenz auf teilweise nur noch drei Sekunden reduzieren. 

Kontoberechtigungen für alle

Cloudflare-Kontoberechtigungen sind ab sofort nicht mehr Enterprise-Kunden vorbehalten, sondern stehen allen unseren Kunden zur Verfügung. Wir zeigen Ihnen auch, wie Sie diese verwenden können und stellen Best Practices vor. 

Vorfallmeldungen

Kunden können jetzt die Vorfallmeldungen von Cloudflare abonnieren und festlegen, wann sie je nach betroffenem Produkt und Ausmaß der Beeinträchtigung informiert werden möchten. 

Dienstag

Neuerung

Das Wichtigste in Kürze

Willkommen in der Connectivity Cloud

Cloudflare ist die weltweit erste Connectivity Cloud – die moderne Art, Clouds, Netzwerke, Anwendungen und Nutzer zu vernetzen und zu schützen. 

Wie Sie die 2 Mrd. USD schwere IPv4-Steuer von Amazon vermeiden können 

Amazon plant, Kunden für IPv4-Adressen 43 USD zu berechnen. Cloudflare wird Ihnen diese „Steuer“ in Form von Gutschriften zurückerstatten. 

Sippy

Mit Sippy können Sie Ihre Gebühren für ausgehenden Traffic auf ein Minimum reduzieren, um ihre Daten schrittweise von AWS zu R2 umzuziehen. 

Cloudflare Images

Alle Bildanpassungsfunktionen werden unter Cloudflare Images verfügbar sein und wir vereinfachen die Preisgestaltung, um sie transparenter und kalkulierbarer zu machen.  

Traffic-Anomalien und Benachrichtigungen mit Cloudflare Radar

Cloudflare Radar wird anomale Traffic-Ereignisse für Länder und Autonome Systeme (ASe) veröffentlichen.

Erkennung von Internetausfällen

Wir schauen uns genauer an, wie Cloudflare Internetausfälle erkennt, welche Herausforderungen damit verbunden sind und welchen Ansatz wir verfolgen, um diese Probleme zu lösen. 

Mittwoch

Neuerung

Das Wichtigste in Kürze

Der weltweit beste Ort für Inferenz-Aufgaben

Jetzt verfügbar: Workers AI, eine Serverless-GPU-Cloud für KI, das Tool Vectorize, mit dem Sie Ihre eigenen Vektordatenbanken erstellen können, und die Lösung AI Gateway, die Ihnen hilft, Kosten und Beobachtbarkeit Ihrer KI-Anwendungen im Griff zu behalten. 

Cloudflare bietet die beste Infrastruktur für KI-Anwendungen der nächsten Generation, unterstützt durch Partnerschaften mit NVIDIA, Microsoft, Hugging Face, Databricks und Meta.

Workers AI 

Einführung von Workers AI: Wir stellen KI-Inferenz auf einer Dienstplattform bereit, über die Entwickler KI-Modelle mit nur wenigen Zeilen Quellcode ausführen können – unterstützt durch unser globales Netzwerk von Grafikprozessoren. 

Partnerschaft mit Hugging Face 

Cloudflare geht eine Partnerschaft mit Hugging Face ein, um KI-Modelle für Nutzer besser zugänglich und erschwinglicher zu machen. 

Vectorize

Die Vektordatenbank von Cloudflare, mit der Softwareingenieure komplette KI-Anwendungen auf dem globalen Netzwerk von Cloudflare entwickeln können, ist jetzt in der Beta-Version verfügbar. 

AI Gateway

AI Gateway bietet Entwicklern mehr Kontrolle und einen besseren Überblick über ihre KI-Anwendungen. So können sie sich auf das Programmieren konzentrieren, ohne sich Gedanken über Beobachtbarkeit, Zuverlässigkeit und Skalierung machen zu müssen. AI Gateway kümmert sich um die Dinge, die für fast alle KI-Applikationen benötigt werden, und spart Entwicklungszeit, damit Sie Ihre Aufmerksamkeit auf Ihre eigentliche Arbeit richten können.

 

WebGPU kann jetzt bei Cloudflare Workers verwendet werden

Entwickler haben jetzt die Möglichkeit, WebGPU in Cloudflare Workers zu verwenden. Erfahren Sie mehr darüber, weshalb WebGPU wichtig sind, warum wir sie unseren Kunden anbieten und was in diesem Bereich als Nächstes ansteht. 

Was KI-Unternehmen mit Cloudflare entwickeln

Viele KI-Unternehmen nutzen Cloudflare zur Erstellung von Anwendungen der nächsten Generation. Erfahren Sie mehr darüber, was genau geschaffen wird und wie Cloudflare dabei Unterstützung bietet. 

Gedichte schreiben mit LLama 2 bei Workers AI

Haben Sie Lust, mit KI-Unterstützung ein Gedicht zu verfassen? Finden Sie heraus, wie Sie Ihren eigenen KI-Chatbot mit nur 14 Zeilen Quellcode auf dem globalen Netzwerk von Cloudflare betreiben können. 

Donnerstag

Neuerung

Das Wichtigste in Kürze

Hyperdrive

Cloudflare bringt ein neues Produkt auf den Markt: Hyperdrive. Die Lösung macht regionale Datenbanken deutlich schneller, indem sie die Bearbeitung der von Cloudflare Workers gestellten Abfragen drastisch beschleunigt.

D1: Open Beta

D1 befindet sich jetzt in der Open Beta-Phase, wobei sich alles um die Skalierung dreht: Mit höheren Speicherlimits pro Datenbank und der Möglichkeit, mehr Datenbanken zu erstellen, bieten wir Entwicklern die Möglichkeit, Anwendungen im Produktivmaßstab bei D1 zu erstellen.

Build Cache bei Pages

Build Cache ist eine Funktion, die Ihre Build-Dauer durch Zwischenspeicherung und das Wiederverwenden von zuvor berechneten Projektkomponenten verkürzt. Ab sofort ist sie in der Beta-Version verfügbar. 

Ausführung von Serverless-Puppeteer mit Workers und Durable Objects

Wir führen eine Browser Rendering-API ein, die es Entwicklern ermöglicht, die Browser-Automatisierungsbibliothek Puppeteer in Workers zu nutzen. Dadurch entfällt die Einrichtung und Wartung eines Browser-Automatisierungssystems im Serverless-Modell entfällt.

Cloudflare unterstützt das Edge Secure Network von Microsoft

Wir sind eine Partnerschaft mit Microsoft Edge eingegangen, um ein schnelles und sicheres VPN direkt im Browser bereitstellen zu können. Die Nutzer müssen nichts Neues installieren oder komplexe Konzepte verstehen, um von Datenschutz auf dem neuesten Stand der Technik auf Netzwerkebene zu profitieren: Der VPN-Dienst Edge Secure Network ist in der neuesten Consumer-Version von Microsoft Edge für die meisten Märkte verfügbar und wird automatisch mit 5 GB Datenvolumen bereitgestellt. 

Der Playground von Cloudflare Workers ist zurück

Wir überarbeiten den Playground, der die Leistungsfähigkeit von Workers demonstriert, mit neuen Entwicklungswerkzeugen und der Möglichkeit, Ihren Quellcode aus dem Playground zu veröffentlichen und sofort im weltumspannenden Netzwerk von Cloudflare bereitzustellen.

Erweiterung des Marktplatzes für Cloudflare-Integrationen

Wir stellen Ihnen die jüngsten Neuzugänge am Cloudflare-Marktplatz für Integrationen vor. Jetzt verfügbar: Sentry, Momento und Turso. 

Eine mit verschiedenen JavaScript-Laufzeitumgebungen kompatible Socket API – wir kündigen eine WinterCG-Spezifikation und eine Polyfill-Funktion für connect() an.

Die Softwareingenieure von Cloudflare und Vercel haben eine vorläufige Spezifikation der connect()-Socket-API zur Überprüfung durch die Community veröffentlicht – zusammen mit einem Node.js kompatiblen Polyfill für die connect()-API, den Entwickler nun nutzen können.

Neue Tarife für Workers

Wir kündigen eine neue Preisgestaltung für Cloudflare Workers an. Ab sofort wird nur noch nach CPU-Zeit abgerechnet und nicht mehr nach ungenutzter Prozessorzeit, in der Ihr Worker auf Rückmeldungen auf Netzwerkanfragen und andere E/A wartet.

Freitag

Neuerung

Das Wichtigste in Kürze

Post-Quanten-Kryptographie allgemein verfügbar 

Cloudflare führt eine Unterstützung von Post-Quanten-Kryptographie für Kunden, Dienste und interne Systeme ein, damit Sie sich proaktiv vor raffinierten Angriffen schützen können. 

Encrypted Client Hello

Wir kündigen einen Beitrag zur allgemeinen Stärkung des Datenschutzes im Internet an: Encrypted Client Hello ist ein neuer Standard, der verhindert, dass Netzwerke ausspähen, welche Websites ein Nutzer aufruft. Er ist jetzt für alle Cloudflare-Tarifoptionen verfügbar. 

Retro Scan für E-Mails 

Cloudflare-Kunden können jetzt Nachrichten in ihren Office 365-Postfächern auf Bedrohungen hin prüfen. Mit dem Retro Scan können Sie jeweils die vergangenen sieben Tage unter die Lupe nehmen, um zu sehen, welche Bedrohungen Ihrem aktuellen E-Mail-Sicherheitstool entgangen sind. 

Turnstile jetzt allgemein verfügbar

Turnstile, der CAPTCHA-Ersatz von Cloudflare, ist jetzt allgemein verfügbar und kann von jedem kostenlos und unbegrenzt genutzt werden. 

KI-gestützte Crawler-Bots

Jeder Cloudflare-Nutzer kann unabhängig der von ihm genutzten Tarifoption bestimmte Kategorien von Bots auswählen, die er zulassen oder blockieren möchte. Dazu gehören auch KI-gestützte Crawler. Wir empfehlen außerdem einen neuen Standard für robots.txt. Dieser erleichtert es Websites, klar festzulegen, auf welche Weise KI-gestützte Bots das Crawling durchgeführen dürfen.

Zero Day-Bedrohungen schon im Vorfeld erkennen

Wir befassen uns eingehender mit dem Cloudflare-Ansatz und der derzeitigen Forschung bezüglich der Erkennung neuer Web-Angriffsvektoren in unserer WAF, noch bevor diese von Sicherheitsforschern identifiziert werden. 

Metriken zur Wahrung des Datenschutzes

Wir tauchen tief in die grundlegenden Konzepte hinter dem Distributed Aggregation Protocol (DAP) ein und liefern Beispiele dazu, wie wir es in unseren quellofenen Aggregatorserver Daphne implementiert haben. 

Post-Quanten-Kryptographie für Ursprungsserver

Wir führen eine Unterstützung von Post-Quanten-Kryptographie für an Ursprungsserver gerichtete ausgehende Verbindungen und Cloudflare Workers fetch()-Aufrufe ein. Erfahren Sie mehr darüber, was wir freigeschaltet haben, wie die Lösung von uns auf sichere Art und Weise eingeführt wurde und wie Sie die Unterstützung noch heute Ihrem Ursprungsserver hinzufügen können. 

Update zur Netzwerk-Performance

Wir liefern die neuesten Benchmark-Ergebnisse von Cloudflare zur Netzwerkperformance sowie einen Einblick in die Tools und Prozesse, die wir zur Überwachung und Verbesserung unserer Netzwerkleistung verwenden. 

Noch eine letzte Sache

Anlässlich des zwölfjährigen Firmenjubiläums von Cloudflare im vergangenen Jahr haben wir das Workers Launchpad Funding Program vorgestellt. Sie können es sich ähnlich wie ein Accelerator-Programm für Start-ups vorstellen. Es richtet sich an Unternehmen, die auf der Entwicklerplattform von Cloudlare Produkte schaffen, und unterliegt keinerlei Einschränkungen hinsichtlich Größe, Entwicklungsstand oder geografischem Standort.

Auffrischung zur Funktionsweise des Launchpad: Jedes Quartal wählen wir eine Gruppe von Start-ups aus, die Zugang zu einer breiten Palette an technischer Beratung, Mentorenschaft und Möglichkeiten zur Mittelbeschaffung erhalten. Dies umfasst unser Founders Bootcamp, „Sprechstunden“ bei unseren Lösungsarchitekten und den „Demo Day“. Außerdem stellen wir bei Bedarf den Kontakt zu einer Community aus mehr als 40 führenden, weltweit aktiven Risikokapitalfirmen her.

Im Gegenzug bitten wir Sie um ehrliches Feedback. Wir möchten wissen, was funktioniert, was nicht funktioniert und was wir für Sie entwickeln sollen. Wir verlangen weder eine Beteiligung an Ihrem Unternehmen noch müssen Sie für die Teilnahme an unserem Programm bezahlen.


Im vergangenen Jahr haben wir Bewerbungen aus fast 60 Ländern erhalten. Wir hatten die Gelegenheit, eng mit 50 erstaunlichen Start-ups in der Früh- und Wachstumsphase zusammenzuarbeiten, die in die ersten beiden Kohorten aufgenommen wurden. Darüber hinaus haben wir unsere Community aus VC-Partnern auf über 40 Firmen und mehr als 2 Milliarden USD an potenziellen Investitionen in Start-ups, die Cloudflare für die Entwicklung nutzen, erweitert.

Der nächste Schritt: Kohorte Nr. 3! Angesichts des kürzlich erfolgten Abschlusses des Programms für Kohorte Nr. 2 (sehen Sie sich ihren Demo Day an!), der Feier des ersten Jahrestags von Launchpad und unserer zahlreichen Ankündigungen in der letzten Woche dachten wir, dass alle ein klein wenig mehr Zeit gut gebrauchen könnten, um sich über diese ganze Neuigkeiten zu informieren. Deshalb verlängern wir die Bewerbungsfrist für Kohorte Nr. 3 um einige Wochen, und zwar bis zum 13. Oktober 2023. Außerdem reservieren wir fünf Plätze für Firmen, die bereits eine der letzten Mittwoch von uns vorgestellten AI-gestützten Lösungen nutzen. Achten Sie also einfach darauf, in Ihrer Bewerbung zu erwähnen, was Sie verwenden.

Wenn Sie die Gelegenheit hatten, sich bei einer schönen Tasse Kaffee unsere Ankündigungen durchzulesen, sollten Sie sich Workers Launchpad ansehen. Die Bewerbung ist ein Kinderspiel: Sie werden damit fertig sein, lange bevor Ihr Kaffee kalt ist.

Bis zum nächsten Mal!

Damit schließen wir unsere Birthday Week 2023 ab. Wir hoffen, es hat Ihnen gefallen, und freuen uns schon auf ein Wiedersehen bei unserer nächsten Innovation Week!


Resumen de la Semana aniversario – consulta todos nuestros anuncios y descubre una oportunidad para empresas emergentes de IA

Post Syndicated from Dina Kozlov original http://blog.cloudflare.com/es-es/birthday-week-2023-wrap-up-es-es/


Birthday Week recap: everything we announced — plus an AI-powered opportunity for startups

Este año, Cloudflare ha alcanzado oficialmente la adolescencia ¡cumplimos 13 años! Celebramos este hito con una serie de anuncios que benefician tanto a nuestros clientes como a la comunidad de Internet.

Desde el desarrollo de aplicaciones en la era de la IA hasta la protección contra los ataques más avanzados que están por llegar, Cloudflare se enorgullece de facilitar herramientas que ayudan a nuestros clientes a mantener una posición de ventaja.

Esperamos que te lo hayas pasado muy bien en este viaje. Si te interesa conocer un resumen de todos nuestros anuncios en esta semana, sigue leyendo:

LUNES

QUÉ

En pocas palabras…

La adopción de Cloudflare puede reducir hasta un 96 % las emisiones

La migración de servicios de red locales a Cloudflare puede reducir hasta en un 96 % las emisiones de carbono. 

Cloudflare Trace

Observa qué reglas y configuraciones se invocan cuando una solicitud HTTP de tu sitio pasa por nuestra red. 

Cloudflare Fonts

Novedad: Cloudflare Fonts. Mejora la privacidad y el rendimiento de los sitios web que utilizan Google Fonts cargando las fuentes directamente desde la red de Cloudflare. 

Cómo enrutamos el tráfico de forma inteligente

Análisis técnico que explica cómo Cloudflare utiliza el aprendizaje automático para enrutar el tráfico de forma inteligente a través de nuestra vasta red. 

Streaming en vivo de baja latencia

Ya está disponible la compatibilidad LL-HLS de Cloudflare Stream en versión beta abierta. Acelera la entrega de vídeos y reduce hasta 3 segundos la latencia que un espectador puede experimentar en su reproductor. 

Permisos de cuenta para todos

Los permisos de cuenta de Cloudflare ya están disponibles para todos nuestros clientes, no solo para planes Enterprise. Además, te mostraremos cómo puedes utilizarlos y las prácticas recomendadas. 

Alertas de incidentes

Ahora los clientes pueden suscribirse a las Alertas de incidentes de Cloudflare y elegir cuándo recibir las notificaciones en función de los productos afectados y el nivel de impacto. 

MARTES

QUÉ

En pocas palabras…

Te damos la bienvenida a la conectividad cloud

Cloudflare es la primera conectividad cloud del mundo, la forma moderna de conectar y proteger tu nube, redes, aplicaciones y usuarios. 

El coste de 2000 millones de dólares que Amazon cobrará por las direcciones IPv4, y cómo puedes evitarlo 

Amazon empezará a cobrar a sus clientes 43 dólares por las direcciones IPv4, pero Cloudflare te lo devuelve en forma de créditos para evitar el pago. 

Sippy

Minimiza las tasas de salida con Sippy para migrar gradualmente tus datos de AWS a R2. 

Cloudflare Images

Todas las funciones de redimensionamiento de imágenes estarán disponibles en Cloudflare Images. Además, simplificamos los precios para que sean más predecibles y fiables.  

Anomalías de tráfico y notificaciones con Cloudflare Radar

Cloudflare Radar publicará eventos de tráfico anómalo en países y sistemas autónomos.

Cómo detectar interrupciones de Internet

Descubre cómo Cloudflare detecta las interrupciones de Internet, los desafíos que conllevan y nuestro enfoque para superar estos problemas. 

MIÉRCOLES

QUÉ

En pocas palabras…

El mejor lugar en Region: planeta Tierra para inferencia

Accede desde ya a Workers AI, una nube de GPU sin servidor para IA; Vectorize, para que puedas crear tus propias bases de datos vectoriales; y AI Gateway, que te permite gestionar los costes y la observabilidad de tus aplicaciones de IA. 

Cloudflare ofrece la mejor infraestructura para aplicaciones de IA de última generación, con el apoyo de nuestros socios NVIDIA, Microsoft, Hugging Face, Databricks y Meta.

Workers AI 

Llega Workers AI, una plataforma de inferencia de IA como servicio, que permite a los desarrolladores ejecutar modelos de IA con solo unas líneas de código, todo ello con la tecnología de nuestra red global de GPU. 

Asociación con Hugging Face 

Cloudflare se ha asociado con Hugging Face para garantizar modelos de IA más accesibles y asequibles para los usuarios. 

Vectorize

Base de datos vectorial de Cloudflare, que permite a los ingenieros crear aplicaciones integrales de IA en la red global de Cloudflare. Ya disponible en versión beta. 

AI Gateway

AI Gateway ayuda a los desarrolladores a mejorar el control y visibilidad de sus aplicaciones de IA, para que te centres en el desarrollo, sin preocuparte por la observabilidad, fiabilidad y escalabilidad. Gestiona todo lo que necesitan la mayoría de ellas, y tienes más tiempo para el desarrollo.

 

Ya puedes utilizar WebGPU en Cloudflare Workers

Los desarrolladores ya pueden utilizar WebGPU en Cloudflare Workers. Descubre por qué las WebGPU son importantes, por qué las ofrecemos a los clientes y los próximos pasos. 

Qué están desarrollando las empresas de IA con Cloudflare

Muchas empresas de IA están utilizando Cloudflare para crear aplicaciones de nueva generación. Descubre lo que están desarrollando y cómo Cloudflare les está ayudando en este camino. 

Escribe poemas con la IA de LLama 2 en Workers AI

¿Quieres escribir un poema utilizando IA? Aprende a ejecutar tu propio chatbot de IA en 14 líneas de código en la red global de Cloudflare. 

JUEVES

QUÉ

En pocas palabras…

Hyperdrive

Cloudflare lanza un nuevo producto, Hyperdrive, que agiliza las bases de datos regionales existentes, ya que acelera de forma asombrosa las consultas que se realizan desde Cloudflare Workers.

D1, ya disponible en versión beta abierta

D1 ya está disponible en versión beta abierta, y el tema es la “escala”. Ofrecemos límites de almacenamiento más elevados por base de datos y la posibilidad de crear más bases de datos, lo que nos permitirá promover el potencial de los desarrolladores para crear aplicaciones a escala de producción en D1.

Building Caching en Pages

Building Caching es una función diseñada para reducir tus tiempos de compilación, gracias al almacenamiento en caché y la reutilización de componentes de proyectos previamente calculados. Ya disponible en versión beta. 

Ejecuta Puppeteer sin servidor con Workers y Durable Objects

Llega Browser Rendering API, que permite a los desarrolladores utilizar la biblioteca de automatización del navegador Puppeteer dentro de Workers, sin necesidad de configurar y mantener el sistema de automatización del navegador sin servidor.

Microsoft utiliza la tecnología de Cloudflare para activar Edge Secure Network

Nos hemos asociado con Microsoft Edge para ofrecer una VPN rápida y segura, directamente en el navegador. Los usuarios no tienen que instalar nada nuevo ni entender conceptos complejos para beneficiarse de lo último en privacidad a nivel de red. La VPN Edge Secure Network está disponible en la última versión para consumidores de Microsoft Edge en la mayoría de los mercados, e incluye 5 GB de datos. 

Actualizamos Cloudflare Workers Playground

Actualizamos la página de pruebas de configuración que demuestra la eficacia de Workers, junto con nuevas herramientas de desarrollo y la posibilidad de compartir tu código e implementarlo instantáneamente en la red global de Cloudflare.

Ampliación del mercado de integraciones de Cloudflare

Anunciamos las últimas incorporaciones a Cloudflare Integrations Marketplace: Sentry, Momento y Turso. 

Una API de socket que se ejecuta en todos los entornos de ejecución de Javascript. Llega la especificación WinterCG y polyfill para connect()

Ingenieros de Cloudflare y Vercel han publicado un borrador de la especificación de la API de sockets connect() para que la revise la comunidad, junto con un polyfill compatible con Node.js para la API connect() que los desarrolladores pueden empezar a utilizar.

Nuevos precios de Workers

Presentamos nuevos precios de Cloudflare Workers, cuya facturación se basará en el tiempo de CPU, nunca en el tiempo inactivo que tu instancia de Worker pase esperando solicitudes de red y otra E/S.

VIERNES

QUÉ

En pocas palabras…

Disponibilidad general de la criptografía poscuántica 

Cloudflare implementa la compatibilidad con la criptografía poscuántica para clientes, servicios y sistemas internos con el fin de proteger de forma proactiva contra ataques avanzados. 

Encrypted Client Hello

Anunciamos nuestra contribución para ayudar a mejorar la privacidad de todos en Internet. Encrypted Client Hello, un nuevo estándar que impide que las redes espíen qué sitios web visita un usuario. Ya disponible en todos los planes de Cloudflare. 

Email Retro Scan 

Ahora los clientes de Cloudflare pueden analizar los mensajes de sus bandejas de entrada de Office 365 en busca de amenazas. Retro Scan te permitirá observar qué amenazas no han sido detectadas por tu herramienta de seguridad del correo electrónico en los siete últimos días. 

Turnstile, ya disponible de forma general

Turnstile, el sustituto de CAPTCHA de Cloudflare, ya está disponible de forma general y gratuita para todo el mundo e incluye uso ilimitado. 

Bots rastreadores con IA

Cualquier usuario suscrito a un plan de Cloudflare, puede elegir las categorías específicas de bots que desea permitir o bloquear, incluidos los rastreadores de IA. También estamos recomendando una nueva norma para robots.txt que facilitará que los sitios web indiquen claramente cómo pueden y no pueden rastrear los bots de IA.

Cómo detectar las amenazas de día cero antes de que ocurran

Descubre el enfoque de Cloudflare y la investigación en curso para detectar nuevos vectores de ataque web en nuestro WAF antes de que los identifique un investigador de seguridad. 

Métricas de preservación de la privacidad

Conoce los conceptos fundamentales del Protocolo de Agregación Distribuida (DAP) con ejemplos de cómo lo hemos implementado en Daphne, nuestro servidor agregador de código abierto. 

Criptografía poscuántica para servidores de origen

Implementamos la compatibilidad con la criptografía poscuántica para conexiones salientes a servidores de origen y las llamadas fetch() de Cloudflare Workers. Descubre más información sobre lo que hemos habilitado, cómo lo hemos implementado de forma segura, y cómo puedes añadir la compatibilidad a tu servidor de origen hoy mismo. 

Actualización del rendimiento de red

Resultados actualizados del rendimiento de Cloudflare en relación con el rendimiento de la red, además de un análisis de las herramientas y procesos que utilizamos para supervisar y mejorar el rendimiento de nuestra red. 

Una cosa más

En nuestro 12.º aniversario el año pasado, anunciamos el programa de financiamiento Workers Launchpad. Puedes considerarlo como un programa cuyo objetivo es impulsar a empresas emergentes que crean sus proyectos en la plataforma para desarrolladores de Cloudlare, sin restricciones de tamaño, fase o geografía.

Repasemos el funcionamiento de Launchpad. Cada trimestre, admitimos a un grupo de empresas emergentes que luego tienen acceso a una amplia gama de oportunidades de asesoramiento técnico, tutorías y recaudación de fondos. Entre las ventajas se incluyen nuestro Founders Bootcamp, las Open Office Hours con nuestros arquitectos de soluciones y el Demo Day. Los que estén preparados para recaudar fondos también se pondrán en contacto con nuestra comunidad de más de 40 empresas líderes mundiales de capital riesgo.

A cambio, solo pedimos tu opinión sincera. Queremos saber qué funciona, qué no y qué necesitas que hagamos por ti. No te pedimos participaciones en tu empresa, ni que pagues por formar parte del programa.


En el último año, hemos recibido solicitudes de casi 60 países diferentes. Hemos tenido la oportunidad de trabajar estrechamente con 50 empresas emergentes increíbles, en etapa de crecimiento, que han sido admitidas en los dos primeros grupos, y hemos ampliado nuestra comunidad de socios de capital riesgo a más de 40 empresas y más de 2000 millones de dólares en inversiones potenciales en empresas emergentes basadas en Cloudflare.

Próximamente: ¡Grupo n.º 3! Con la reciente finalización del grupo n.º 2 (¡echa un vistazo a su ¡Demo Day!), la celebración del 1.º aniversario del Launchpad y todo lo que anunciamos la semana pasada, hemos pensado que necesitaréis más tiempo para poneros al día con todas las noticias, por lo que hemos ampliado unas semanas el plazo para el grupo n.º 3, hasta el 13 de octubre de 2023. Y vamos a reservar 5 plazas en la clase para quienes ya estén utilizando alguno de los anuncios de IA del miércoles pasado. Solo asegúrate de mencionar en tu solicitud lo que estás utilizando.

Así que, una vez que hayas tenido la oportunidad de echar un vistazo a los anuncios y te hayas servido un café, echa un vistazo a Workers Launchpad. Solicitarlo es muy fácil, de hecho habrás completado el proceso mucho antes de que se te enfríe el café.

¡Hasta la próxima!

Así despedimos la Semana aniversario 2023. Esperamos que la hayas disfrutado, y nos vemos en nuestra próxima ¡semana de la innovación!


Introducing per hostname TLS settings — security fit to your needs

Post Syndicated from Dina Kozlov original http://blog.cloudflare.com/introducing-per-hostname-tls-settings/

Introducing per hostname TLS settings — security fit to your needs

Introducing per hostname TLS settings — security fit to your needs

One of the goals of Cloudflare is to give our customers the necessary knobs to enable security in a way that fits their needs. In the realm of SSL/TLS, we offer two key controls: setting the minimum TLS version, and restricting the list of supported cipher suites. Previously, these settings applied to the entire domain, resulting in an “all or nothing” effect. While having uniform settings across the entire domain is ideal for some users, it sometimes lacks the necessary granularity for those with diverse requirements across their subdomains.

It is for that reason that we’re excited to announce that as of today, customers will be able to set their TLS settings on a per-hostname basis.

The trade-off with using modern protocols

In an ideal world, every domain could be updated to use the most secure and modern protocols without any setbacks. Unfortunately, that's not the case. New standards and protocols require adoption in order to be effective. TLS 1.3 was standardized by the IETF in April 2018. It removed the vulnerable cryptographic algorithms that TLS 1.2 supported and provided a performance boost by requiring only one roundtrip, as opposed to two. For a user to benefit from TLS 1.3, they need their browser or device to support the new TLS version. For modern browsers and devices, this isn’t a problem – these operating systems are built to dynamically update to support new protocols. But legacy clients and devices were, obviously, not built with the same mindset. Before 2015, new protocols and standards were developed over decades, not months or years, so the clients were shipped out with support for one standard — the one that was used at the time.

If we look at Cloudflare Radar, we can see that about 62.9% of traffic uses TLS 1.3. That’s quite significant for a protocol that was only standardized 5 years ago. But that also means that a significant portion of the Internet continues to use TLS 1.2 or lower.

The same trade-off applies for encryption algorithms. ECDSA was standardized in 2005, about 20 years after RSA. It offers a higher level of security than RSA and uses shorter key lengths, which adds a performance boost for every request. To use ECDSA, a domain owner needs to obtain and serve an ECDSA certificate and the connecting client needs to support cipher suites that use elliptical curve cryptography (ECC). While most publicly trusted certificate authorities now support ECDSA-based certificates, the slow rate of adoption has led many legacy systems to only support RSA, which means that restricting applications to only support ECC-based algorithms could prevent access from those that use older clients and devices.

Balancing the trade-offs

When it comes to security and accessibility, it’s important to find the right middle ground for your business.

To maintain brand, most companies deploy all of their assets under one domain. It’s common for the root domain (e.g. example.com) to be used as a marketing website to provide information about the company, its mission, and the products and services it offers. Then, under the same domain, you might have your company blog (e.g. blog.example.com), your management portal (e.g. dash.example.com), and your API gateway (e.g. api.example.com).

The marketing website and the blog are similar in that they’re static sites that don’t collect information from the accessing users. On the other hand, the management portal and API gateway collect and present sensitive data that needs to be protected.

When you’re thinking about which settings to deploy, you want to consider the data that’s exchanged and the user base. The marketing website and blog should be accessible to all users. You can set them up to support modern protocols for the clients that support them, but you don’t necessarily want to restrict access for users that are accessing these pages from old devices.

The management portal and API gateway should be set up in a manner that provides the best protection for the data exchanged. That means dropping support for less secure standards with known vulnerabilities and requiring new, secure protocols to be used.

To be able to achieve this setup, you need to be able to configure settings for every subdomain within your domain individually.

Per hostname TLS settings – now available!

Customers that use Cloudflare’s Advanced Certificate Manager can configure TLS settings on individual hostnames within a domain. Customers can use this to enable HTTP/2, or to configure the minimum TLS version and the supported ciphers suites on a particular hostname. Any settings that are applied on a specific hostname will supersede the zone level setting. The new capability also allows you to have different settings on a hostname and its wildcard record; which means you can configure example.com to use one setting, and *.example.com to use another.

Let’s say that you want the default min TLS version for your domain to be TLS 1.2, but for your dashboard and API subdomains, you want to set the minimum TLS version to be TLS 1.3. In the Cloudflare dashboard, you can set the zone level minimum TLS version to 1.2 as shown below. Then, to make the minimum TLS version for the dashboard and API subdomains TLS 1.3, make a call to the per-hostname TLS settings API endpoint with the specific hostname and setting.

Introducing per hostname TLS settings — security fit to your needs

This is all available, starting today, through the API endpoint! And if you’d like to learn more about how to use our per-hostname TLS settings, please jump on over to our developer documentation.

Bring your own CA for client certificate validation with API Shield

Post Syndicated from Dina Kozlov original http://blog.cloudflare.com/bring-your-own-ca-for-client-certificate-validation-with-api-shield/

Bring your own CA for client certificate validation with API Shield

Bring your own CA for client certificate validation with API Shield

APIs account for more than half of the total traffic of the Internet. They are the building blocks of many modern web applications. As API usage grows, so does the number of API attacks. And so now, more than ever, it’s important to keep these API endpoints secure. Cloudflare’s API Shield solution offers a comprehensive suite of products to safeguard your API endpoints and now we’re excited to give our customers one more tool to keep their endpoints safe. We’re excited to announce that customers can now bring their own Certificate Authority (CA) to use for mutual TLS client authentication. This gives customers more security, while allowing them to maintain control around their Mutual TLS configuration.

The power of Mutual TLS (mTLS)

Traditionally, when we refer to TLS certificates, we talk about the publicly trusted certificates that are presented by servers to prove their identity to the connecting client. With Mutual TLS, both the client and the server present a certificate to establish a two-way channel of trust. Doing this allows the server to check who the connecting client is and whether or not they’re allowed to make a request. The certificate presented by the client – the client certificate – doesn’t need to come from a publicly trusted CA. In fact, it usually comes from a private or self-signed CA. That’s because the only party that needs to be able to trust it is the connecting server. As long as the connecting server has the client certificate and can check its validity, it doesn’t need to be public.

Securing API endpoints with Mutual TLS

Mutual TLS plays a crucial role in protecting API endpoints. When it comes to safeguarding these endpoints, it's important to have a security model in place that only allows authorized clients to make requests and keeps everyone else out.

That’s why when we launched API Shield in 2020 – a product that’s centered around securing API endpoints – we included mutual TLS client certificate validation as a part of the offering. We knew that mTLS was the best way for our customers to identify and authorize their connecting clients.

When we launched mutual TLS for API Shield, we gave each of our customers a dedicated self-signed CA that they could use to issue client certificates. Once the certificates are installed on devices and mTLS is set up, administrators can enforce that connections can only be made if they present a client certificate issued from that self-signed CA.

This feature has been paramount in securing thousands of endpoints, but it does require our customer to install new client certificates on their devices, which isn’t always possible. Some customers have been using mutual TLS for years with their own CA, which means that the client certificates are already in the wild. Unless the application owner has direct control over the clients, it’s usually arduous, if not impossible, to replace the client certificates with ones issued from Cloudflare’s CA. Other customers may be required to use a CA issued from an approved third party in order to meet regulatory requirements.

To help all of our customers keep their endpoints secure, we’re extending API Shield’s mTLS capability to allow customers to bring their own CA.

Bring your own CA for client certificate validation with API Shield

Get started today

To simplify the management of private PKI at Cloudflare, we created one account level endpoint that enables customers to upload self-signed CAs to use across different Cloudflare products. Today, this endpoint can be used for API shield CAs and for Gateway CAs that are used for traffic inspection.

If you’re an Enterprise customer, you can upload up to five CAs to your account. Once you’ve uploaded the CA, you can use the API Shield hostname association API to associate the CA with the mTLS enabled hostnames. That will tell Cloudflare to start validating the client certificate against the uploaded CA for requests that come in on that hostname. Before you enforce the client certificate validation, you can create a Firewall rule that logs an event when a valid or invalid certificate is served. That will help you determine if you’ve set things up correctly before you enforce the client certificate validation and drop unauthorized requests.

To learn more about how you can use this, refer to our developer documentation.

If you’re interested in using mutual TLS to secure your corporate network, talk to an account representative about using our Access product to do so.

Announcing Cloudflare Secrets Store

Post Syndicated from Dina Kozlov original http://blog.cloudflare.com/secrets-store/

Announcing Cloudflare Secrets Store

Announcing Cloudflare Secrets Store

We’re excited to announce Secrets Store – Cloudflare’s new secrets management offering!

A secrets store does exactly what the name implies – it stores secrets. Secrets are variables that are used by developers that contain sensitive information – information that only authorized users and systems should have access to.

If you’re building an application, there are various types of secrets that you need to manage. Every system should be designed to have identity & authentication data that verifies some form of identity in order to grant access to a system or application. One example of this is API tokens for making read and write requests to a database. Failure to store these tokens securely could lead to unauthorized access of information – intentional or accidental.

The stakes with secret’s management are high. Every gap in the storage of these values has potential to lead to a data leak or compromise. A security administrator’s worst nightmare.

Developers are primarily focused on creating applications, they want to build quickly, they want their system to be performant, and they want it to scale. For them, secrets management is about ease of use, performance, and reliability. On the other hand, security administrators are tasked with ensuring that these secrets remain secure. It’s their responsibility to safeguard sensitive information, ensure that security best practices are met, and to manage any fallout of an incident such as a data leak or breach. It’s their job to verify that developers at their company are building in a secure and foolproof manner.

In order for developers to build at high velocity and for security administrators to feel at ease, companies need to adopt a highly reliable and secure secrets manager. This should be a system that ensures that sensitive information is stored with the highest security measures, while maintaining ease of use that will allow engineering teams to efficiently build.

Why Cloudflare is building a secrets store

Cloudflare’s mission is to help build a better Internet – that means a more secure Internet. We recognize our customers’ need for a secure, centralized repository for storing sensitive data. Within the Cloudflare ecosystem, are various places where customers need to store and access API and authorization tokens, shared secrets, and sensitive information. It’s our job to make it easy for customers to manage these values securely.

The need for secrets management goes beyond Cloudflare. Customers have sensitive data that they manage everywhere – at their cloud provider, on their own infrastructure, across machines. Our plan is to make our Secrets Store a one-stop shop for all of our customer’s secrets.

The evolution of secrets at Cloudflare

In 2020, we launched environment variables and secrets for Cloudflare Workers, allowing customers to create and encrypt variables across their Worker scripts. By doing this, developers can obfuscate the value of a variable so that it’s no longer available in plaintext and can only be accessed by the Worker.

Announcing Cloudflare Secrets Store

Adoption and use of these secrets is quickly growing. We now have more than three million Workers scripts that reference variables and secrets managed through Cloudflare. One piece of feedback that we continue to hear from customers is that these secrets are scoped too narrowly.

Today, customers can only use a variable or secret within the Worker that it’s associated with. Instead, customers have secrets that they share across Workers. They don’t want to re-create those secrets and focus their time on keeping them in sync. They want account level secrets that are managed in one place but are referenced across multiple Workers scripts and functions.

Outside of Workers, there are many use cases for secrets across Cloudflare services.

Inside our Web Application Firewall (WAF), customers can make rules that look for authorization headers in order to grant or deny access to requests. Today, when customers create these rules, they put the authorization header value in plaintext, so that anyone with WAF access in the Cloudflare account can see its value. What we’ve heard from our customers is that even internally, engineers should not have access to this type of information. Instead, what our customers want is one place to manage the value of this header or token, so that only authorized users can see, create, and rotate this value. Then when creating a WAF rule, engineers can just reference the associated secret e.g.“account.mysecretauth”. By doing this, we help our customers secure their system by reducing the access scope and enhance management of this value by keeping it updated in one place.

Announcing Cloudflare Secrets Store

With new Cloudflare products and features quickly developing, we’re hearing more and more use cases for a centralized secrets manager. One that can be used to store Access Service tokens or shared secrets for Webhooks.

With the new account level Secrets Store, we’re excited to give customers the tools they need to manage secrets across Cloudflare services.

Securing the Secret Store

To have a secrets store, there are a number of measures that need to be in place, and we’re committing to providing these for our customers.

First, we’re going to give the tools that our customers need to restrict access to secrets. We will have scope permissions that will allow admins to choose which users can view, create, edit, or remove secrets. We also plan to add the same level of granularity to our services – giving customers the ability to say “only allow this Worker to access this secret and only allow this set of Firewall rules to access that secret”.

Announcing Cloudflare Secrets Store

Next, we’re going to give our customers extensive audits that will allow them to track the access and use of their secrets. Audit logs are crucial for security administrators. They can be used to alert team members that a secret was used by an unauthorized service or that a compromised secret is being accessed when it shouldn’t be. We will give customers audit logs for every secret-related event, so that customers can see exactly who is making changes to secrets and which services are accessing and when.

In addition to the built-in security of the Secrets Store, we’re going to give customers the tools to rotate their encryption keys on-demand or at a cadence that fits the right security posture for them.

Sign up for the beta

We’re excited to get the Secrets Store in our customer’s hands. If you’re interested in using this, please fill out this form, and we’ll reach out to you when it’s ready to use.

Out now! Auto-renew TLS certifications with DCV Delegation

Post Syndicated from Dina Kozlov original https://blog.cloudflare.com/introducing-dcv-delegation/

Out now! Auto-renew TLS certifications with DCV Delegation

Out now! Auto-renew TLS certifications with DCV Delegation

To get a TLS certificate issued, the requesting party must prove that they own the domain through a process called Domain Control Validation (DCV). As industry wide standards have evolved to enhance security measures, this process has become manual for Cloudflare customers that manage their DNS externally. Today, we’re excited to announce DCV Delegation — a feature that gives all customers the ability offload the DCV process to Cloudflare, so that all certificates can be auto-renewed without the management overhead.

Security is of utmost importance when it comes to managing web traffic, and one of the most critical aspects of security is ensuring that your application always has a TLS certificate that’s valid and up-to-date. Renewing TLS certificates can be an arduous and time-consuming task, especially as the recommended certificate lifecycle continues to gradually decrease, causing certificates to be renewed more frequently. Failure to get a certificate renewed can result in downtime or insecure connection which can lead to revenue decrease, mis-trust with your customers, and a management nightmare for your Ops team.

Every time a certificate is renewed with a Certificate Authority (CA), the certificate needs to pass a check called Domain Control Validation (DCV). This is a process that a CA goes through to verify that the party requesting the certificate does in fact own or control ownership over the domain for which the certificate is being requested. One of the benefits of using Cloudflare as your Authoritative DNS provider is that we can always prove ownership of your domain and therefore auto-renew your certificates. However, a big chunk of our customers manage their DNS externally. Before today, certificate renewals required these customers to make manual changes every time the certificate came up for renewal. Now, with DCV Delegation – you can let Cloudflare do all the heavy lifting.

DCV primer

Before we dive into how DCV Delegation works, let’s talk about it. DCV is the process of verifying that the party requesting a certificate owns or controls the domain for which they are requesting a certificate.

Out now! Auto-renew TLS certifications with DCV Delegation

When a subscriber requests a certificate from a CA, the CA returns validation tokens that the domain owner needs to place. The token can be an HTTP file that the domain owner needs to serve from a specific endpoint or it can be a DNS TXT record that they can place at their Authoritative DNS provider. Once the tokens are placed, ownership has been proved, and the CA can proceed with the certificate issuance.

Better security practices for certificate issuance

Certificate issuance is a serious process. Any shortcomings can lead to a malicious actor issuing a certificate for a domain they do not own. What this means is that the actor could serve the certificate from a spoofed domain that looks exactly like yours and hijack and decrypt the incoming traffic. Because of this, over the last few years, changes have been put in place to ensure higher security standards for certificate issuances.

Shorter certificate lifetimes

The first change is the move to shorter lived certificates. Before 2011, a certificate could be valid for up to 96 months (about eight years). Over the last few years, the accepted validity period has been significantly shortened. In 2012, certificate validity went down to 60 months (5 years), in 2015 the lifespan was shortened to 39 months (about 3 years), in 2018 to 24 months (2 years), and in 2020, the lifetime was dropped to 13 months. Following the trend, we’re going to continue to see certificate lifetimes decrease even further to 3 month certificates as the standard. We’re already seeing this in action with Certificate Authorities like Let’s Encrypt and Google Trust Services offering a maximum validity period of 90 days (3 months). Shorter-lived certificates are aimed to reduce the compromise window in a situation where a malicious party has gained control over a TLS certificate or private key. The shorter the lifetime, the less time the bad actor can make use of the compromised material. At Cloudflare, we even give customers the ability to issue 2 week certificates to reduce the impact window even further.

While this provides a better security posture, it does require more overhead management for the domain owner, as they’ll now be responsible for completing the DCV process every time the certificate is up for renewal, which can be every 90 days. In the past, CAs would allow the re-use of validation tokens, meaning even if the certificate was renewed more frequently, the validation tokens could be re-used so that the domain owner wouldn’t need to complete DCV again. Now, more and more CAs are requiring unique tokens to be placed for every renewal, meaning shorter certificate lifetimes now result in additional management overhead.

Wildcard certificates now require DNS-based DCV

Aside from certificate lifetimes, the process required to get a certificate issued has developed stricter requirements over the last few years. The Certificate Authority/Browser Forum (CA/B Forum), the governing body that sets the rules and standards for certificates, has enforced or stricter requirements around certificate issuance to ensure that certificates are issued in a secure manner that prevents a malicious actor from obtaining certificates for domains they do not own.

In May 2021, the CA/B Forum voted to require DNS based validation for any certificate with a wildcard certificate on it. Meaning, that if you would like to get a TLS certificate that covers example.com and *.example.com, you can no longer use HTTP based validation, but instead, you will need to add TXT validation tokens to your DNS provider to get that certificate issued. This is because a wildcard certificate covers a large portion of the domain’s namespace. If a malicious actor receives a certificate for a wildcard hostname, they now have control over all of the subdomains under the domain. Since HTTP validation only proves ownership of a hostname and not the whole domain, it’s better to use DNS based validation for a certificate with broader coverage.

All of these changes are great from a security standpoint – we should be adopting these processes! However, this also requires domain owners to adapt to the changes. Failure to do so can lead to a certificate renewal failure and downtime for your application. If you’re managing more than 10 domains, these new processes become a management nightmare fairly quickly.

At Cloudflare, we’re here to help. We don’t think that security should come at the cost of reliability or the time that your team spends managing new standards and requirements. Instead, we want to make it as easy as possible for you to have the best security posture for your certificates, without the management overhead.

How Cloudflare helps customers auto-renew certificates

Out now! Auto-renew TLS certifications with DCV Delegation

For years, Cloudflare has been managing TLS certificates for 10s of millions of domains. One of the reasons customers choose to manage their TLS certificates with Cloudflare is that we keep up with all the changes in standards, so you don’t have to.

One of the superpowers of having Cloudflare as your Authoritative DNS provider is that Cloudflare can add necessary DNS records on your behalf to ensure successful certificate issuances. If you’re using Cloudflare for your DNS, you probably haven’t thought about certificate renewals, because you never had to. We do all the work for you.

When the CA/B Forum announced that wildcard certificates would now require TXT based validation to be used, customers that use our Authoritative DNS didn’t even notice any difference – we continued to do the auto-renewals for them, without any additional work on their part.

While this provides a reliability and management boost to some customers, it still leaves out a large portion of our customer base — customers who use Cloudflare for certificate issuance with an external DNS provider.

There are two groups of customers that were impacted by the wildcard DCV change: customers with domains that host DNS externally – we call these “partial” zones – and SaaS providers that use Cloudflare’s SSL for SaaS product to provide wildcard certificates for their customers’ domains.

Customers with “partial” domains that use wildcard certificates on Cloudflare are now required to fetch the TXT DCV tokens every time the certificate is up for renewal and manually place those tokens at their DNS provider. With Cloudflare deprecating DigiCert as a Certificate Authority, certificates will now have a lifetime of 90 days, meaning this manual process will need to occur every 90 days for any certificate with a wildcard hostname.

Customers that use our SSL for SaaS product can request that Cloudflare issues a certificate for their customer’s domain – called a custom hostname. SaaS providers on the Enterprise plan have the ability to extend this support to wildcard custom hostnames, meaning we’ll issue a certificate for the domain (example.com) and for a wildcard (*.example.com). The issue with that is that SaaS providers will now be required to fetch the TXT DCV tokens, return them to their customers so that they can place them at their DNS provider, and do this process every 90 days. Supporting this requires a big change to our SaaS provider’s management system.

At Cloudflare, we want to help every customer choose security, reliability, and ease of use — all three! And that’s where DCV Delegation comes in.

Enter DCV Delegation: certificate auto-renewal for every Cloudflare customer

DCV Delegation is a new feature that allows customers who manage their DNS externally to delegate the DCV process to Cloudflare. DCV Delegation requires customers to place a one-time record that allows Cloudflare to auto-renew all future certificate orders, so that there’s no manual intervention from the customer at the time of the renewal.

How does it work?

Customers will now be able to place a CNAME record at their Authoritative DNS provider at their acme-challenge endpoint – where the DCV records are currently placed – to point to a domain on Cloudflare.

This record will have the the following syntax:

_acme-challenge.<domain.TLD> CNAME <domain.TLD>.<UUID>.dcv.cloudflare.com

Let’s say I own example.com and need to get a certificate issued for it that covers the apex and wildcard record. I would place the following record at my DNS provider: _acme-challenge.example.com CNAME example.com.<UUID>.dcv.cloudflare.com. Then, Cloudflare would place the two TXT DNS records required to issue the certificate at  example.com.<UUID>.dcv.cloudflare.com.

As long as the partial zone or custom hostname remains Active on Cloudflare, Cloudflare will add the DCV tokens on every renewal. All you have to do is keep the CNAME record in place.

If you’re a “partial” zone customer or an SSL for SaaS customer, you will now see this card in the dashboard with more information on how to use DCV Delegation, or you can read our documentation to learn more.

DCV Delegation for Partial Zones:

Out now! Auto-renew TLS certifications with DCV Delegation

DCV Delegation for Custom Hostnames:

Out now! Auto-renew TLS certifications with DCV Delegation

The UUID in the CNAME target is a unique identifier. Each partial domain will have its own UUID that corresponds to all of the DCV delegation records created under that domain. Similarly, each SaaS zone will have one UUID that all custom hostnames under that domain will use. Keep in mind that if the same domain is moved to another account, the UUID value will change and the corresponding DCV delegation records will need to be updated.

If you’re using Cloudflare as your Authoritative DNS provider, you don’t need to worry about this! We already add the DCV tokens on your behalf to ensure successful certificate renewals.

What’s next?

Right now, DCV Delegation only allows delegation to one provider. That means that if you’re using multiple CDN providers or you’re using Cloudflare to manage your certificates but you’re also issuing certificates for the same hostname for your origin server then DCV Delegation won’t work for you. This is because once that CNAME record is pointed to Cloudflare, only Cloudflare will be able to add DCV tokens at that endpoint, blocking you or an external CDN provider from doing the same.

However, an RFC draft is in progress that will allow each provider to have a separate “acme-challenge” endpoint, based on the ACME account used to issue the certs. Once this becomes standardized and CAs and CDNs support it, customers will be able to use multiple providers for DCV delegation.

In conclusion, DCV delegation is a powerful feature that simplifies the process of managing certificate renewals for all Cloudflare customers. It eliminates the headache of managing certificate renewals, ensures that certificates are always up-to-date, and most importantly, ensures that your web traffic is always secure. Try DCV delegation today and see the difference it can make for your web traffic!

Protect your key server with Keyless SSL and Cloudflare Tunnel integration

Post Syndicated from Dina Kozlov original https://blog.cloudflare.com/protect-your-key-server-with-keyless-ssl-and-cloudflare-tunnel-integration/

Protect your key server with Keyless SSL and Cloudflare Tunnel integration

Protect your key server with Keyless SSL and Cloudflare Tunnel integration

Today, we’re excited to announce a big security enhancement to our Keyless SSL offering. Keyless SSL allows customers to store their private keys on their own hardware, while continuing to use Cloudflare’s proxy services. In the past, the configuration required customers to expose the location of their key server through a DNS record – something that is publicly queryable. Now, customers will be able to use our Cloudflare Tunnels product to send traffic to the key server through a secure channel, without publicly exposing it to the rest of the Internet.

A primer on Keyless SSL

Security has always been a critical aspect of online communication, especially when it comes to protecting sensitive information. Today, Cloudflare manages private keys for millions of domains which allows the data communicated by a client to stay secure and encrypted. While Cloudflare adopts the strictest controls to secure these keys, certain industries such as financial or medical services may have compliance requirements that prohibit the sharing of private keys.In the past, Cloudflare required customers to upload their private key in order for us to provide our L7 services. That was, until we built out Keyless SSL in 2014, a feature that allows customers to keep their private keys stored on their own infrastructure while continuing to make use of Cloudflare’s services.

While Keyless SSL is compatible with any hardware that support PKCS#11 standard, Keyless SSL users frequently opt to secure their private keys within HSMs (Hardware Security Modules), which are specialized machines designed to be tamper proof and resistant to to unauthorized access or manipulation, secure against attacks, and optimized to efficiently execute cryptographic operations such as signing and decryption. To make it easy for customers to set this up, during Security Week in 2021, we launched integrations between Keyless SSL and HSM offerings from all major cloud providers.

Protect your key server with Keyless SSL and Cloudflare Tunnel integration

Strengthening the security of key servers even further

In order for Cloudflare to communicate with a customer’s key server, we have to know the IP address associated with it. To configure Keyless SSL, we ask customers to create a DNS record that indicates the IP address of their keyserver. As a security measure, we ask customers to keep this record under a long, random hostname such as “11aa40b4a5db06d4889e48e2f738950ddfa50b7349d09b5f.example.com”. While it adds a layer of obfuscation to the location of the key server, it does expose the IP address of the keyserver to the public Internet, allowing anyone to send requests to that server. We lock the connection between Cloudflare and the Keyless server down through Mutual TLS, so that the Keyless server should only accept the request if a Cloudflare client certificate associated with the Keyless client is served. While this allows the key server to drop any requests with an invalid or missing client certificate, the key server is still publicly exposed, making it susceptible to attacks.

Protect your key server with Keyless SSL and Cloudflare Tunnel integration

Instead, Cloudflare should be the only party that knows about this key server’s location, as it should be the only party making requests to it.

Enter: Cloudflare Tunnel

Instead of re-inventing the wheel, we decided to make use of an existing Cloudflare product that our customers use to protect the connections between Cloudflare and their origin servers — Cloudflare Tunnels!

Protect your key server with Keyless SSL and Cloudflare Tunnel integration

Cloudflare Tunnel gives customers the tools to connect incoming traffic to their private networks without exposing those networks to the Internet through a public hostname. It works by having customers install a Cloudflare daemon, called “cloudflared” which Cloudflare’s client will then connect to.

Now, customers will be able to use the same functionality but for connections made to their key server.

Getting started

Protect your key server with Keyless SSL and Cloudflare Tunnel integration

To set this up, customers will need to configure a virtual network on Cloudflare – this is where customers will tell us the IP address or hostname of their key server. Then, when uploading a Keyless certificate, instead of telling us the public hostname associated with the key server, customers will be able to tell us the virtual network that resolves to it. When making requests to the key server, Cloudflare’s gokeyless client will automatically connect to the “cloudflared” server and will continue to use Mutual TLS as an additional security layer on top of that connection. For more instructions on how to set this up , check out our Developer Docs.

If you’re an Enterprise customer and are interested in using Keyless SSL in conjunction with Cloudflare Tunnels, reach out to your account team today to get set up.