1

When using Cloudflare's free shared SSL feature, the certificate for your website is shared with dozens of others websites via the use of SANs (Subject Alternate Names).

Of course some of these websites may be malicious, contain adult content, be politically extreme, etc, which could result in guilt by association by an over-zealous internet censor.

Is this a realistic and common threat, where by your website gets blocked by corporate proxies, school web filters, etc just because it shares a SAN with a bad website? Or are censors designed to ignore these associations due to the wide use of services such as Cloudflare where SANs are used in this way.

This question addresses some of the confidentiality and integrity concerns, but my question is specifically about availability.

1

The answer is, as with most anything in the filtering world, maybe, if...

By default a modern application-layer firewall (filtering proxy, etc) won't look at the SANs on the TLS certificate. That takes a decent extra punch to the available resources for something that isn't always accurate. Most systems use the host headers (for web pages), or various other indicators depending on the application being used (streaming host for rtsp, IP addresses for straight TCP, etc).

Heck, most systems don't even break into the TLS certificates because SSL inspections are costly (in resources) and cause certificate errors to appear in the end client (unless they are re-signing with an explicitly trusted internal certificate, in which case wow, that is a lot of security killing and privacy bashing mixed into one fun-sized package). That isn't to say that no one does it. I've worked on security devices for places that required an SSBI before I could know what brand equipment they used, those guys didn't care that employees might feel intruded upon if their personal email account warned about being on an untrusted connection (the employees were warned up front that all network traffic was fully monitored and recorded, for required security reasons). The other people notorious for this are public schools (I mean in the kinder thru secondary school [K-12] type, not universities). Most jurisdictions have laws in place to protect minor children from the fact that the internet is dark and full of terrors, and several of these require that best efforts be made to guarantee that whatever a kiddo accesses is checked for bad-thing-levels. So schools quite commonly strip open online privacy to levels equal to national security contractors or government-operated-ISP levels. (again, everyone knows up front).

So if you're target audience is public (K-12) schools or businesses in the national defense game, yes it is a threat. In fact, for those target audiences, any shared service (hosting, SSL, email, etc) is an equal threat because of the possibility of being tainted by a co-tenant of the same service.

In reality, availability denial due to SSL sharing is a minimum risk for most folks who would use Shared SSL. Once you account for the security horribleness of the feature (it isn't security, it doesn't provide SSL protection, all it is good for is letting you keep a plain HTTP [no-s] web site without modern browsers slapping "insecure" all over it) the only reason to use Shared SSL is because you don't really need SSL at all except the browsers are making you.

Anyone who actually needs SSL should have their own certs without letting other folks touch the private keys.

1

Naomi Wu (aka @RealSexyCyborg on Twitter) is dealing with almost this exact issue right now. After being deplatformed without recourse by her previous funding site, she moved to a funding site that promised not to censor based on content. Of course the site has attracted other clientele that is actively trying to avoid censorship, which includes several politically extreme groups and hate groups, and of course adult sites. The funding site's very existence is now being threatened primarily due to the hate groups using it, and she's likely to be shut out again.

I would recommend minimizing the ways in which your site's name is associated in any way with any site names that are not under your control. Even the most innocuous of neighboring sites may turn out to be poorly managed, and later taken over by hackers or spammers. This certainly can blow back on you.

  • Ah yes I had heard about Naomi Wu's story regarding this. Many large sites behind Cloudflare using the free SSL service also have other less-desirable hostnames in their SANs. – rubberband876 Jan 28 at 23:17
  • 1
    I don't see the connection. The OP is asking a specific technical question about Cloudflare's shared SSL certificates, not a question about online platforms in general. – duskwuff Jan 29 at 3:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.