Connection is not private for Spaces CDN with Certificate from Cloudflare

Question

Hi,

I am using Cloudflare to manager the domain, I add a subdomain cdn.<domain> to spaces cdn by Borrow own certificate, and I created ssl certificate on cloudflare for the this subdomain.
However, it gives me the connection is not private when I try to connect to space cdn.

The steps I am following
https://support.cloudflare.com/hc/en-us/articles/115000479507
https://www.digitalocean.com/docs/spaces/how-to/customize-cdn-endpoint/

Answer 1

bobbyiliev August 4, 2020

Hi there @imj,

What I could suggest is decoding the SSL certificate to make sure that your domain name is correctly defined in there.

You could do that with the following command:

openssl x509 -in your_certificate.crt -text -noout

Or using an online tool like the SSL Shopper: https://www.sslshopper.com/certificate-decoder.html

For example, if you are using www.cdn.yourdomain.com you need to make sure that the www version of your domain name is also specified in the SANs of the certificate.

Regards,
Bobby

Reply Report

imj August 6, 2020

Thank Bobby,

I used SSL Shopper and find the domain is in there

Common Name: CloudFlare Origin Certificate
Subject Alternative Names: cdn.ntrpg.net
Organization: CloudFlare, Inc.
Organization Unit: CloudFlare Origin CA
Valid From: July 27, 2020
Valid To: July 24, 2035
Issuer: CloudFlare, Inc.
Serial Number: …
Reply Report
- bobbyiliev August 6, 2020
  
  Hi there @imj,
  
  I’ve just rat a test against your domain name using the SSL checker tool:
  
  https://www.sslshopper.com/ssl-checker.html#hostname=%20cdn.ntrpg.net
  
  It reported that the certificate is not trusted in all web browsers as you may need to install an Intermediate/chain certificate to link it to a trusted root certificate.
  
  Let me know how it goes.
  
  Regards,
  Bobby
  
  Reply Report
  
  imj August 6, 2020
  
  Hi Bobby,
  
  Thanks, I think I did add Cloudflare Origin CA — RSA Root as the cert chain into do by folllowing the doc of cloudflare
  
  https://support.cloudflare.com/hc/en-us/articles/115000479507
  
  Or I added wrong one?
  
  Reply Report
  
  bobbyiliev August 7, 2020
  
  Hi there @imj,
  
  Have you tried adding the CA and the Root CA as well one after another?
  
  Regards,
  Bobby
  
  Reply Report
  
  imj August 10, 2020
  
  Yes, I did. for the cert chain, I added the root cert contents in. Or should I use the pem file link?
  
  Reply Report
  
  bobbyiliev August 12, 2020
  
  Hi there @imj,
  
  In order to make sure that this works you need to set the Proxy status for your CNAME to Proxied rather than DNS only.
  
  I tested this at my end and it seems to work as expected.
  
  If you set this to DNS only you would get the warning as the Cloudflare Origin CA certificates only encrypt traffic between Cloudflare and your origin web server and are not trusted by client browsers when directly accessing your origin website outside of Cloudflare. For subdomains that utilize Origin CA certificates, pausing or disabling Cloudflare causes untrusted certificate errors for site visitors as stated in their documentation here:
  
  https://support.cloudflare.com/hc/en-us/articles/115000479507-What-are-the-root-certificate-authorities-CAs-used-with-Cloudflare-Origin-CA-
  
  Hope that this helps!
  Regards,
  Bobby
  
  Reply Report

Answer 2

imj August 6, 2020

Thank Bobby,

I used SSL Shopper and find the domain is in there

Common Name: CloudFlare Origin Certificate
Subject Alternative Names: cdn.ntrpg.net
Organization: CloudFlare, Inc.
Organization Unit: CloudFlare Origin CA
Valid From: July 27, 2020
Valid To: July 24, 2035
Issuer: CloudFlare, Inc.
Serial Number: …
Reply Report
- bobbyiliev August 6, 2020
  
  Hi there @imj,
  
  I’ve just rat a test against your domain name using the SSL checker tool:
  
  https://www.sslshopper.com/ssl-checker.html#hostname=%20cdn.ntrpg.net
  
  It reported that the certificate is not trusted in all web browsers as you may need to install an Intermediate/chain certificate to link it to a trusted root certificate.
  
  Let me know how it goes.
  
  Regards,
  Bobby
  
  Reply Report
  
  imj August 6, 2020
  
  Hi Bobby,
  
  Thanks, I think I did add Cloudflare Origin CA — RSA Root as the cert chain into do by folllowing the doc of cloudflare
  
  https://support.cloudflare.com/hc/en-us/articles/115000479507
  
  Or I added wrong one?
  
  Reply Report
  
  bobbyiliev August 7, 2020
  
  Hi there @imj,
  
  Have you tried adding the CA and the Root CA as well one after another?
  
  Regards,
  Bobby
  
  Reply Report
  
  imj August 10, 2020
  
  Yes, I did. for the cert chain, I added the root cert contents in. Or should I use the pem file link?
  
  Reply Report
  
  bobbyiliev August 12, 2020
  
  Hi there @imj,
  
  In order to make sure that this works you need to set the Proxy status for your CNAME to Proxied rather than DNS only.
  
  I tested this at my end and it seems to work as expected.
  
  If you set this to DNS only you would get the warning as the Cloudflare Origin CA certificates only encrypt traffic between Cloudflare and your origin web server and are not trusted by client browsers when directly accessing your origin website outside of Cloudflare. For subdomains that utilize Origin CA certificates, pausing or disabling Cloudflare causes untrusted certificate errors for site visitors as stated in their documentation here:
  
  https://support.cloudflare.com/hc/en-us/articles/115000479507-What-are-the-root-certificate-authorities-CAs-used-with-Cloudflare-Origin-CA-
  
  Hope that this helps!
  Regards,
  Bobby
  
  Reply Report

Related

Question

Connection is not private for Spaces CDN with Certificate from Cloudflare

Leave a comment

Looking for something else?

Sign up for our newsletter

Related

Question

Connection is not private for Spaces CDN with Certificate from Cloudflare

Leave a comment

Related

question

How did my database got hacked ?

question

Connect to DB installed into dedicated VPS (private networking)

question

Spaces CDN HTTP/2 support

question

How to create team without Credit Card?

Looking for something else?