13

I have a free Cloudflare account where I manage my domain (ie: mydomain.com) and I use the free SSL certificate (mode Full SSL) in order to get SSL on a subdomain (blog.mydomain.com hosted with Github Pages).

The domain root is not secured by Cloudflare SSL but it has its own separate SSL certificate.

As you probably know the Cloudflare SSL certificate is shared between several domains (often adult sites) and it's a wildcard type. (so it contains *.mydomain.com, *.malicious.com, mydomain.com, malicious.com)

The web application is hosted on mydomain.com and app.mydomain.com is also secured with its own SSL certificate. Can these domains somehow be in danger because they share a certificate with malicious.com and malicious.com probably has access to the same SSL certificate shared with mydomain.com?

Improve this question
1
  • I have seen the odd case of access to sites being blocked because one of the sites the free certificate was shared by was blocked by zealous monitoring tools. Not common, but possible.
    – Matthew
    Jun 22, 2016 at 21:08

1 Answer 1

Reset to default
10

The web application hosted on mydomain.com or at app.mydomain.com (also secured with its own SSL certificate) can be somehow be in dangerous by the owner of malicious.com because he has access to the same SSL certificate shared by mydomain.com?

The owner of the malicious domain has no access to the private key certificate served by Cloudflare and neither do you. The certificates for the free accounts are owned by Cloudflare and only Cloudflare has access to the private key of the (shared) certificate.

It is also not a problem that you share the same certificate and/or IP address with a potentially malicious domain. The same origin inside the browsers only cares about domain names, not certificates or IP addresses and thus it is not possible to get access from the malicious domain to your domain. The usual CSRF, XSS... attacks of course still work, but these are not related to same certificate or not but to security problems of a specific web application.

Improve this answer
6
  • thanks for your answer. I'm not a security expert but at least now I'm not worried about the cloudflare ssl certificate
    – user35912
    Dec 12, 2015 at 15:12
  • Won't this allow malicious.com to spoof mydomain.com if it can establish a MiTM? I know that isn't easy, but MiTM protection is one of the things SSL is intended to protect against and it is weakened here. Not a huge deal, but a definite decrease in security.
    – Neil Smithline
    Dec 12, 2015 at 21:28
  • @NeilSmithline: The endpoint of the client connection is Cloudflare. They will determine which host was requested and then forward the request to this original server. I don't see how a malicious server could spoof another server in this scenario because neither would it receive the requests from the proper server nor would requests to the malicious server send to the proper server. And of course the response would only be read from the server where the request was sent to.
    – Steffen Ullrich
    Dec 13, 2015 at 4:26
  • I think a MiTM could alter the IP address from one CloudFlare host to another. If SNI isn't being used, CloudFlare will let the wrong host respond to the request. The client won't be able to tell because the same cert is used for both the correct and malicious host.
    – Neil Smithline
    Dec 14, 2015 at 14:51
  • 1
    @NeilSmithline: with the free SSL SNI is used and the attempt to access the site without SNI will result in a TLS alert only. Apart from that the HTTP host header is checked too. But there are other interesting attacks in this area which affected several CDN, see TLS virtual host confusion.
    – Steffen Ullrich
    Dec 14, 2015 at 14:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .