0

First of all I want to address a thought I had which is that they might market their ability to read the encrypted code being sent so they can spot "bots" and such, and that this is why they need to be able to decrypt the communication. This is valid but I think that I would prefer this being a program like fail2ban instead where you can anonymize certain information before it's being sent for example (if it has to be processed on a remote server).

But it seems that it's not even that. Cloudflare's stated benefit for keyless SSL:

Companies are able to get all of the benefits of the cloud (DDoS attack mitigation, load balancing, WAN optimization), [...] (source)

These functions don't seem to rely on them having to read the decrypted communications.

So it is as I thought.

The simple act of having a load balancer as a service requires them to be in a position where they can intercept SSL communication.

I guess this is because if you have SSL between an IP (let's say 127.0.0.1) and cloudflare, and they then add a domain and reverse proxy for this, they can't send two certificates so they must remove the previous encryption first.

Is it so? And if it is so, why?

4
  • By design, Cloudflare's WAF must MITM the connection between the client and your server, in order to perform its function. See security.stackexchange.com/questions/260992/… for more info.
    – mti2935
    Jan 19 at 12:35
  • Cloudflare's WAF does much more than just DDoS attack mitigation, load balancing, WAN optimization. It also prevents application level attacks, such as SQL injection attacks, XSS attacks, and more. To prevent these types of attacks, the WAF needs MITM the connection so that it can see the unencrypted requests from the clients, and block any that are malicious, as Steffen pointed out below.
    – mti2935
    Jan 19 at 12:58
  • 1
    Your quote from Cloudflare strips the relevant context, and you generalised it. That makes that quote meaningless. Yet you've used it to make a conclusion.
    – schroeder
    Jan 19 at 13:14
  • 1
    What do you mean by "encrypt twice"? What's being encrypted twice? And what would that solve? How does that "solve" having a CDN?
    – schroeder
    Jan 19 at 13:16

1 Answer 1

2

The simple act of having a load balancer as a service requires them to be in a position where they can intercept SSL communication.

Cloudflare is not simply a load balancer as a service which does MITM the traffic to annoy the users or to sniff private information. It needs access to the actual requests in order to provide functionality, i.e. caching, protection against bots, web application firewall ... .

7
  • Why can't we encrypt twice instead of having Cloudflare MITM half the internet?
    – Henrik F
    Jan 19 at 12:39
  • 3
    @HenrikF: because then Cloudflare would not have access to the requests, which it needs to provide the stated functionality. Jan 19 at 12:40
  • 1
    @HenrikF have you considered that those functions could benefit from being able to inspect the packet contents? You appear to reject that notion out-of-hand, but why? Are you unaware of how packet inspection could benefit those things?
    – schroeder
    Jan 19 at 13:41
  • 1
    @HenrikF: You citation seems to come from keyless SSL. Here "WAN optimization" is likely their SD-WAN which includes DNS filtering and Secure Web Gateway - the latter needs visibility of the decrypted traffic. As for the features of DDoS protection see here, but it includes WAF, CDN, image optimzation, Accelerated Mobile Pages, Bot mitigation - which also need visibility of the decrypted requests. Jan 19 at 16:55
  • 1
    @HenrikF: ... and some features of load balancing also need this visibility, like session affinity (bind HTTP sessions to a specific upstream) or routing based on URL. In summary: while some features might be done with passive network inspection many actually need access to the application data, which in case of encrypted connections means that decryption is needed. Jan 19 at 16:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .