Comment by kazinator
5 hours ago
If this is HTTPS, how would Cloudfare have the certificate for your domain so that browsers don't warn about a mismatch?
Or is it that when you sign over DNS to a provider, they can take over your cert? They can "ass-cert" their own? :)
Yes, the person who controls the DNS controls the certificate.
What a certificate is supposed to verify is that traffic is going to the right place. If you designate cloudflare as the rightful host of your website then they can get a certificate.
This isn't an edge case though. This is cloudflare's primary product. It is why users use them.
As far as I know they terminate all TLS; it’s one of the tradeoffs using them.
They have a product called Magic Transit that offers DDoS protection and such for plain IP traffic, where Cloudflare does not terminate TLS. Pricing is not public but starts in the five-digit USD per month range according to people I talk to.
This may tell you something about how keen Cloudflare are to handle traffic they themselves cannot decrypt.
Magic Transit uses BGP magic to work. That only makes sense at scale - i believe you have to have your own ASN for it to work.
Realistically its a totally different product, and 5 digit price is probably cheap relative to competitors in that space.