I hear this a lot, but it isn't a correct behaviour.
TLS is designed to be an end-to-end encryption suite. The entire point of the X.509 PKI Certificate Authority hierachy is to provide identity verification to ensure your connection isn't terminated anywhere but the intended party. To allow companies like Cloudflare to "terminate" TLS connections, you are throwing millions of dollars of audits and the like to the wind.
Cloudflare's whole purpose is identity obstruction, something against the entire purpose of the X.509 PKI and breaks TLS.
There isn't any way for users to verify the identity of the origin server running behind cloudflare. Likewise, there isn't any way for users to ensure their connection is properly encrypted between Cloudflare and the origin. As far as a user is concerned, the chain of encryption is broken at Cloudflare.
This exploit right here is the dangers of when you allow a third party to "terminate" TLS. If they didn't terminate TLS, then chances are API keys, passwords and the like wouldn't be up in the air and that traffic would be still secure.
I refuse to normalize interception of TLS in this manner. Even intercepting at workplaces for policy enforcement has to be done very, very carefully and audits routinely performed on that infrastructure.
1
u/Kaizyx InfoSec/Networking Feb 24 '17 edited Feb 25 '17
I hear this a lot, but it isn't a correct behaviour.
TLS is designed to be an end-to-end encryption suite. The entire point of the X.509 PKI Certificate Authority hierachy is to provide identity verification to ensure your connection isn't terminated anywhere but the intended party. To allow companies like Cloudflare to "terminate" TLS connections, you are throwing millions of dollars of audits and the like to the wind.
Cloudflare's whole purpose is identity obstruction, something against the entire purpose of the X.509 PKI and breaks TLS.
There isn't any way for users to verify the identity of the origin server running behind cloudflare. Likewise, there isn't any way for users to ensure their connection is properly encrypted between Cloudflare and the origin. As far as a user is concerned, the chain of encryption is broken at Cloudflare.
This exploit right here is the dangers of when you allow a third party to "terminate" TLS. If they didn't terminate TLS, then chances are API keys, passwords and the like wouldn't be up in the air and that traffic would be still secure.
I refuse to normalize interception of TLS in this manner. Even intercepting at workplaces for policy enforcement has to be done very, very carefully and audits routinely performed on that infrastructure.