1

I'm using Cloudflare to serve my GitHub pages website with a custom domain over HTTPS. I noticed that the Cloudflare certificate I received is valid for many domains (according to it's details on Safari). Is is possible for someone else to man-in-the-middle users trying to access my website by redirecting them to another domain for which my certificate is valid?

Also, is it possible to test this locally using Burp Suite?

Improve this question
0

1 Answer 1

Reset to default
0

I'm not familiar with Cloudflare, so this is more general.

In theory, it's possible for someone to change the Cloudflare front-end configuration to point your site at somebody else's server, then redirect back to your server, but it seems unlikely.

You can always test for incoming IP addresses to see if they're the ones you're expecting from Cloudflare. If they're not, the chances are they are coming from another server. In order to MITM, they would have to forward the intercepted traffic to your servers, so you can inspect the IP addresses to see if they're the ones you're expecting.

Other than that, I'm not sure what signals you would look for; the MITM server would try to masquerade as a Cloudflare server (and might actually be one, if the attacker could take over such a server). Burp Suite might be to indicate what a false signature looks like. You could also try a timing probe, browsing to your web site, and seeing if the timing is as you expect, or whether it is longer than expected; the latter might indicate that the connection has been routed through another server.

Of course, for any of this, you'll need baseline data, indicating what the "normal" state of affairs is.

Improve this answer
1