Post #1826088

2026-04-25 22:43 UTC

I'll be more specific: if you set up a website on your own server, and use Cloudflare as a reverse proxy. If you do SSL yourself, on your own server, then the traffic is encrypted between the client and your server, and therefore Cloudflare cannot read it, they do not have the encryption keys, even though the traffic is passing through them. If you use Cloudflare's https solution, Cloudflare provides the keys and decrypts the traffic before passing it on. The former is the more secure way to do it, but they encourage you to do it the way where they get to read all the traffic, which is pretty shady of them, because if a website has https people assume that means it is end to end encrypted to the website itself, but that assumption is being violated here and a user has no way to know.

Replies (2)

@Lee@retrolemmy.com 2026-04-26 10:33

You should check the certificate shown to clients when accessing your domain. I think you'll find that it is not the certificate that you created outside of Cloudflare. Cloudflare doesn't need your private key as they issue a certificate for your domain to themselves and use that for the connection with the client. The certificate you created is used between Cloudflare and your server. The only option I'm aware to route traffic through Cloudflare where they don't terminate SSL is an enterprise only feature.

Open ##1826091
@bjoern_tantau@swg-empire.de 2026-04-26 00:09

How can they act as a proxy if they can't terminate the connection? Or what service does that offer? I guess they could filter out some connections based on IP addresses. But is that enough for some customers? Or am I overlooking something?

Open ##1826092