SSL – Noise

How Cloudflare is helping domain owners with the upcoming Entrust CA distrust by Chrome and Mozilla

Dina Kozlov — Fri, 20 Sep 2024 07:00:00 +0000

Chrome and Mozilla will stop trusting Entrust’s public TLS certificates issued after November 2024 due to concerns about Entrust’s compliance with security standards. In response, Entrust is partnering with SSL.com to continue providing trusted certificates. Cloudflare will support SSL.com as a CA, simplifying certificate management for customers using Entrust by automating issuance and renewals.

Introducing Automatic SSL/TLS: securing and simplifying origin connectivity

Alex Krivit — Thu, 08 Aug 2024 13:05:18 +0000

This new Automatic SSL/TLS setting will maximize and simplify the encryption modes Cloudflare uses to communicate with origin servers by using the SSL/TLS Recommender

Avoiding downtime: modern alternatives to outdated certificate pinning practices

Dina Kozlov — Mon, 29 Jul 2024 13:00:37 +0000

The number of outages caused by certificate pinning is increasing. We’ll explore why certificate pinning hasn’t kept up with modern standards and recommend alternatives to improve security while reducing management overhead

How we ensure Cloudflare customers aren’t affected by Let’s Encrypt’s certificate chain change

Dina Kozlov — Fri, 12 Apr 2024 13:00:09 +0000

Let’s Encrypt’s cross-signed chain will be expiring in September. This will affect legacy devices with outdated trust stores (Android versions 7.1.1 or older). To prevent this change from impacting customers, Cloudflare will shift Let’s Encrypt certificates upon renewal to use a different CA

Upcoming Let’s Encrypt certificate chain change and impact for Cloudflare customers

Dina Kozlov — Thu, 14 Mar 2024 14:00:23 +0000

Let’s Encrypt’s cross-signed chain will be expiring in September. To prepare for the change, after May 15th, 2024, Cloudflare will start issuing certs from Let’s Encrypt’s ISRG X1 chain. This change will impact legacy devices with outdated trust stores (Android versions 7.1.1 or older)

AWS Certificate Manager will discontinue WHOIS lookup for email-validated certificates

Lerna Ekmekcioglu — Tue, 09 Jan 2024 20:31:55 +0000

AWS Certificate Manager (ACM) is a managed service that you can use to provision, manage, and deploy public and private TLS certificates for use with Amazon Web Services (AWS) and your internal connected resources. Today, we’re announcing that ACM will be discontinuing the use of WHOIS lookup for validating domain ownership when you request email-validated […]

Introducing per hostname TLS settings — security fit to your needs

Dina Kozlov — Wed, 09 Aug 2023 13:00:41 +0000

Starting today, customers that use Cloudflare’s Advanced Certificate Manager can configure TLS settings on individual hostnames within a domain

Bring your own CA for client certificate validation with API Shield

Dina Kozlov — Tue, 11 Jul 2023 13:00:21 +0000

API shield customers can now upload their own CA to use for client certificate validation. This ensures that only authorized clients and devices can make requests to your API endpoint or application.

A new, configurable and scalable version of Geo Key Manager, now available in Closed Beta

Dina Kozlov — Thu, 15 Dec 2022 14:00:00 +0000

We’re excited to announce a new version of Geo Key Manager — one that allows customers to define boundaries by country, by a region, or by a standard, such as “only store my private keys in FIPS compliant data centers” — now available in Closed Beta.

How to evaluate and use ECDSA certificates in AWS Certificate Manager

Zachary Miller — Tue, 08 Nov 2022 17:37:21 +0000

AWS Certificate Manager (ACM) is a managed service that enables you to provision, manage, and deploy public and private SSL/TLS certificates that you can use to securely encrypt network traffic. You can now use ACM to request Elliptic Curve Digital Signature Algorithm (ECDSA) certificates and associate the certificates with AWS services like Application Load Balancer (ALB) […]

Critical Vulnerability in Open SSL

Bruce Schneier — Fri, 28 Oct 2022 13:12:50 +0000

There are no details yet, but it’s really important that you patch Open SSL 3.x when the new version comes out on Tuesday.

How bad is “Critical”? According to OpenSSL, an issue of critical severity affects common configurations and is also likely exploitable.

It’s likely to be abused to disclose server memory contents, and potentially reveal user details, and could be easily exploited remotely to compromise server private keys or execute code execute remotely. In other words, pretty much everything you don’t want happening on your production systems...

Total TLS: one-click TLS for every hostname you have

Dina Kozlov — Thu, 06 Oct 2022 18:00:00 +0000

Today, we’re excited to announce Total TLS — a one-click feature that will issue individual TLS certificates for every subdomain in our customer’s domains

Amazon introduces dynamic intermediate certificate authorities

Adina Lozada — Wed, 14 Sep 2022 22:02:40 +0000

AWS Certificate Manager (ACM) is a managed service that lets you provision, manage, and deploy public and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for use with Amazon Web Services (AWS) and your internal connected resources. Starting October 11, 2022, at 9:00 AM Pacific Time, public certificates obtained through ACM will be issued from […]

Introducing new Cloudflare for SaaS documentation

Mia Malden — Tue, 09 Aug 2022 13:00:00 +0000

Cloudflare for SaaS offers a suite of Cloudflare products and add-ons to improve the security, performance, and reliability of SaaS providers. Now, the Cloudflare for SaaS documentation outlines how to optimize it in order to meet your goals

Introducing: Backup Certificates

Dina Kozlov — Mon, 14 Mar 2022 12:59:10 +0000

We are excited to introduce backup certificates to increase reliability of our service for anyone using the Cloudflare platform in the event of key compromises or related issues

Cloudflare for SaaS for All, now Generally Available!

Dina Kozlov — Fri, 22 Oct 2021 15:31:00 +0000

We are very excited to announce that Cloudflare for SaaS is generally available, so that every customer, big and small, can use Cloudflare for SaaS to continue scaling and building their SaaS business.

Introducing SSL/TLS Recommender

Suleman Ahmad — Tue, 12 Oct 2021 13:01:00 +0000

Introducing customized recommendations to improve the security of your website.

Staging TLS Certificate: Make every deployment a safe deployment

Dina Kozlov — Wed, 06 Oct 2021 12:56:13 +0000

We are excited to announce that Enterprise customers now have the ability to test custom uploaded certificates in a staging environment before pushing them to production.

What’s new with Cloudflare for SaaS?

Dina Kozlov — Tue, 07 Sep 2021 12:57:06 +0000

Today, we’re excited to announce all the customizations that our team has been working on for our Enterprise customers — for both Cloudflare for SaaS and SSL for SaaS.

Round 2 post-quantum TLS is now supported in AWS KMS

Alex Weibel — Mon, 16 Nov 2020 20:25:58 +0000

AWS Key Management Service (AWS KMS) now supports three new hybrid post-quantum key exchange algorithms for the Transport Layer Security (TLS) 1.2 encryption protocol that’s used when connecting to AWS KMS API endpoints. These new hybrid post-quantum algorithms combine the proven security of a classical key exchange with the potential quantum-safe properties of new post-quantum […]