How Cloudflare is helping domain owners with the upcoming Entrust CA distrust by Chrome and Mozilla

Chrome and Mozilla announced that they will stop trusting Entrust’s public TLS certificates issued after November 12, 2024 and December 1, 2024, respectively. This decision stems from concerns related to Entrust’s ability to meet the CA/Browser Forum’s requirements for a publicly trusted certificate authority (CA). To prevent Entrust customers from being impacted by this change, Entrust has announced that they are partnering with SSL.com, a publicly trusted CA, and will be issuing certs from SSL.com’s roots to ensure that they can continue to provide their customers with certificates that are trusted by Chrome and Mozilla. 

We’re excited to announce that we’re going to be adding SSL.com as a certificate authority that Cloudflare customers can use. This means that Cloudflare customers that are currently relying on Entrust as a CA and uploading their certificate manually to Cloudflare will now be able to rely on Cloudflare’s certificate management pipeline for automatic issuance and renewal of SSL.com certificates. 

CA distrust: responsibilities, repercussions, and responses

With great power comes great responsibility Every publicly trusted certificate authority (CA) is responsible for maintaining a high standard of security and compliance to ensure that the certificates they issue are trustworthy. Continue reading

Avoiding downtime: modern alternatives to outdated certificate pinning practices

In today’s world, technology is quickly evolving and some practices that were once considered the gold standard are quickly becoming outdated. At Cloudflare, we stay close to industry changes to ensure that we can provide the best solutions to our customers. One practice that we’re continuing to see in use that no longer serves its original purpose is certificate pinning. In this post, we’ll dive into certificate pinning, the consequences of using it in today’s Public Key Infrastructure (PKI) world, and alternatives to pinning that offer the same level of security without the management overhead.  

PKI exists to help issue and manage TLS certificates, which are vital to keeping the Internet secure – they ensure that users access the correct applications or servers and that data between two parties stays encrypted. The mis-issuance of a certificate can pose great risk. For example, if a malicious party is able to issue a TLS certificate for your bank’s website, then they can potentially impersonate your bank and intercept that traffic to get access to your bank account. To prevent a mis-issued certificate from intercepting traffic, the server can give a certificate to the client and say “only trust connections if Continue reading

Avoiding downtime: modern alternatives to outdated certificate pinning practices

In today’s world, technology is quickly evolving and some practices that were once considered the gold standard are quickly becoming outdated. At Cloudflare, we stay close to industry changes to ensure that we can provide the best solutions to our customers. One practice that we’re continuing to see in use that no longer serves its original purpose is certificate pinning. In this post, we’ll dive into certificate pinning, the consequences of using it in today’s Public Key Infrastructure (PKI) world, and alternatives to pinning that offer the same level of security without the management overhead.  

PKI exists to help issue and manage TLS certificates, which are vital to keeping the Internet secure – they ensure that users access the correct applications or servers and that data between two parties stays encrypted. The mis-issuance of a certificate can pose great risk. For example, if a malicious party is able to issue a TLS certificate for your bank’s website, then they can potentially impersonate your bank and intercept that traffic to get access to your bank account. To prevent a mis-issued certificate from intercepting traffic, the server can give a certificate to the client and say “only trust connections if Continue reading

How we ensure Cloudflare customers aren’t affected by Let’s Encrypt’s certificate chain change

Let’s Encrypt, a publicly trusted certificate authority (CA) that Cloudflare uses to issue TLS certificates, has been relying on two distinct certificate chains. One is cross-signed with IdenTrust, a globally trusted CA that has been around since 2000, and the other is Let’s Encrypt’s own root CA, ISRG Root X1. Since Let’s Encrypt launched, ISRG Root X1 has been steadily gaining its own device compatibility.

On September 30, 2024, Let’s Encrypt’s certificate chain cross-signed with IdenTrust will expire. After the cross-sign expires, servers will no longer be able to serve certificates signed by the cross-signed chain. Instead, all Let’s Encrypt certificates will use the ISRG Root X1 CA.

Most devices and browser versions released after 2016 will not experience any issues as a result of the change since the ISRG Root X1 will already be installed in those clients’ trust stores. That's because these modern browsers and operating systems were built to be agile and flexible, with upgradeable trust stores that can be updated to include new certificate authorities.

The change in the certificate chain will impact legacy devices and systems, such as devices running Android version 7.1.1 (released in 2016) or older, as those exclusively Continue reading

Birthday Week recap: everything we announced — plus an AI-powered opportunity for startups

This year, Cloudflare officially became a teenager, turning 13 years old. We celebrated this milestone with a series of announcements that benefit both our customers and the Internet community.

From developing applications in the age of AI to securing against the most advanced attacks that are yet to come, Cloudflare is proud to provide the tools that help our customers stay one step ahead.

We hope you’ve had a great time following along and for anyone looking for a recap of everything we launched this week, here it is:

Monday

生日周回顾：我们宣布的所有内容，以及为初创企业提供的 AI 驱动机会

今年，Cloudflare 正式成为踏入青春阶段，迎来了 13 岁生日。为了庆祝这个里程碑，我们发布了一系列公告，我们的客户和互联网社区都会从中受益。

从在人工智能时代开发应用，到防御尚未出现的最先进攻击，Cloudflare 很高兴能提供帮助我们的客户保持领先一步的工具。

我们希望您跟随我们度过了一段美好的时光，如果想要回顾我们本周发布的所有内容，请查看下文：

周一

周二

周三

Die Birthday Week im Rückblick: alle unsere Ankündigungen und eine KI-gestützte Chance für Start-ups

Dieses Jahr ist Cloudflare offiziell ins Teenager-Alter eingetreten, denn wir feiern unser 13-jähriges Firmenjubiläum. Anlässlich dieses Meilensteins haben wir eine Reihe von neuen Produkten vorgestellt, von denen sowohl unseren Kunden als auch die Internet-Community im Allgemeinen profitieren werden.

Von der Anwendungsentwicklung im Zeitalter der KI bis hin zum Schutz vor den ausgefeiltesten Angriffen, die noch erdacht werden müssen: Mit den Werkzeugen von Cloudflare sind unsere Kunden dem Geschehen immer einen Schritt voraus.

Wir hoffen, dass unsere Ankündigungen für Sie von Interesse waren. Sollten Sie befürchten, etwas verpasst zu haben, finden Sie hier noch einmal ein Überblick über alles, was wir während der Birthday Week eingeführt haben:

Montag

Resumen de la Semana aniversario – consulta todos nuestros anuncios y descubre una oportunidad para empresas emergentes de IA

Este año, Cloudflare ha alcanzado oficialmente la adolescencia ¡cumplimos 13 años! Celebramos este hito con una serie de anuncios que benefician tanto a nuestros clientes como a la comunidad de Internet.

Desde el desarrollo de aplicaciones en la era de la IA hasta la protección contra los ataques más avanzados que están por llegar, Cloudflare se enorgullece de facilitar herramientas que ayudan a nuestros clientes a mantener una posición de ventaja.

Esperamos que te lo hayas pasado muy bien en este viaje. Si te interesa conocer un resumen de todos nuestros anuncios en esta semana, sigue leyendo:

LUNES

Récapitulatif de la Semaine anniversaire : tout ce que nous avons annoncé, ainsi qu'une opportunité fondée sur l'IA et dédiée aux start-ups

Cette année, Cloudflare est officiellement entrée dans l'adolescence, puisque l'entreprise a fêté ses 13 ans. Nous avons fêté cet événement avec une série d'annonces qui profitent à la fois à nos clients et à la communauté Internet.

Du développement d'applications à l'ère de l'IA à la sécurisation contre des attaques extrêmement avancées et encore inconnues, Cloudflare est fière de fournir des outils qui aident nos clients à garder une longueur d'avance.

Nous espérons que vous avez passé un excellent moment à suivre notre actualité, et pour tous ceux qui souhaiteraient pouvoir consulter un récapitulatif de toutes les innovations que nous avons inaugurées cette semaine, le voici :

Lundi

バースデーウィークの総括：当社のすべての発表、そしておよびスタートアップ企業にとってのAI活用の機会

今年、Cloudflareは正式にティーンエイジャーとなり、13歳を迎えました。当社ではこの節目を、お客様とインターネットコミュニティの双方に有益な一連の発表で祝いました。

AI時代のアプリケーション開発から、これから起こる最先端の攻撃に対するセキュリティまで、Cloudflareはお客様が一歩先を行くためのツールを提供できることを誇りに思っています。

当社が今週発表したすべてのニュースをまとめてご紹介します：

月曜日

火曜日

水曜日

木曜日

金曜日

追加

Cloudflareが昨年12周年を迎えた折、Workers Launchpad Funding Programを発表しました。クラウドレアのデベロッパー・プラットフォーム上に構築する企業のためのスタートアップ加速プログラムのようなもので、企業の規模、ステージ、地域に制限はありません。

Launchpadの仕組みについての振り返り：四半期ごとに、私たちはスタートアップのグループを選出し、幅広い技術的アドバイス、指導、資金調達の機会を提供しています。これには、ファウンダーズ・ブートキャンプ、ソリューション・アーキテクトによるオープン・オフィス・アワー、デモ・デーなどが含まれます。また、資金調達の準備が整ったスタートアップは、40社以上のグローバルな大手ベンチャーキャピタルのコミュニティに参加することができます。

その代わり、率直な感想の提供を依頼しています。当社では、何がうまくいき、何がうまくいかず、何が必要なのかを知りたいのです。当社は、貴企業への出資者となることを求めることはなく、プログラムに参加するために費用を負担することも求めていません。

ここまで、60か国近くからの応募を受けてきました。当社は、最初の2つのコホートに参加した50の見事な初期および成長段階の新興企業と緊密に協力する機会を得、当社のVCパートナー・コミュニティを40社以上に拡大し、Cloudflareを基盤とする新興企業への潜在的な投資額は20億ドルを超えました。

次は、コホート#3となります。 先日、第2コホートが終了し（デモ・デーをぜひご覧ください）、Launchpadの1歳の誕生日を祝い、そして先週行ったたくさんの発表の間に、皆様にすべてのニュースにキャッチアップしていただくために十分な時間をとることが必要だと考えました。そのため、第3コホートの締め切りを数週間延長し、2023年10月13日とします。また、先週水曜日に発表されたAIのいずれかをすでに利用している方のために、5名分の枠を確保しています。応募時には、現在お使いいただいているものを明記していただけるよう、お願いいたします。

お知らせをチェックし、コーヒーを飲んで休んだら、Workers Launchpadをチェックしてみてください。応募は簡単です。コーヒーが冷めないうちに、応募は完了するでしょう。

次回まで

2023年のバースデーウィークは、以上です。また次回のイノベーション・ウィークでお会いしましょう！

창립기념일 주간 요약: Cloudflare에서 발표한 모든 내용 및 스타트업을 위한 AI를 기반으로 한 기회

올해 Cloudflare에서는 공식적으로 13주년을 맞습니다. 우리는 이 이정표를 고객과 인터넷 커뮤니티 모두에 이점을 선사하는 다양한 발표로 기념했습니다.

AI 시대에 애플리케이션을 개발하는 것부터 아직 등장하지도 않은 최신 위협으로부터 보호하는 것까지 Cloudflare에서는 고객이 한 발자국 앞서 있을 수 있도록 도구를 제공한다는 사실을 자랑스럽게 여깁니다.

이러한 발표를 지켜보며 즐거운 시간이 되셨기를 바랍니다. 이번 주에 출시한 제품의 요약은 다음과 같습니다.

월요일

Introducing per hostname TLS settings — security fit to your needs

One of the goals of Cloudflare is to give our customers the necessary knobs to enable security in a way that fits their needs. In the realm of SSL/TLS, we offer two key controls: setting the minimum TLS version, and restricting the list of supported cipher suites. Previously, these settings applied to the entire domain, resulting in an “all or nothing” effect. While having uniform settings across the entire domain is ideal for some users, it sometimes lacks the necessary granularity for those with diverse requirements across their subdomains.

It is for that reason that we’re excited to announce that as of today, customers will be able to set their TLS settings on a per-hostname basis.

The trade-off with using modern protocols

In an ideal world, every domain could be updated to use the most secure and modern protocols without any setbacks. Unfortunately, that's not the case. New standards and protocols require adoption in order to be effective. TLS 1.3 was standardized by the IETF in April 2018. It removed the vulnerable cryptographic algorithms that TLS 1.2 supported and provided a performance boost by requiring only one roundtrip, as opposed to two. For a user to benefit from Continue reading

Bring your own CA for client certificate validation with API Shield

APIs account for more than half of the total traffic of the Internet. They are the building blocks of many modern web applications. As API usage grows, so does the number of API attacks. And so now, more than ever, it’s important to keep these API endpoints secure. Cloudflare’s API Shield solution offers a comprehensive suite of products to safeguard your API endpoints and now we’re excited to give our customers one more tool to keep their endpoints safe. We’re excited to announce that customers can now bring their own Certificate Authority (CA) to use for mutual TLS client authentication. This gives customers more security, while allowing them to maintain control around their Mutual TLS configuration.

The power of Mutual TLS (mTLS)

Traditionally, when we refer to TLS certificates, we talk about the publicly trusted certificates that are presented by servers to prove their identity to the connecting client. With Mutual TLS, both the client and the server present a certificate to establish a two-way channel of trust. Doing this allows the server to check who the connecting client is and whether or not they’re allowed to make a request. The certificate presented by the client - the client certificate Continue reading

Announcing Cloudflare Secrets Store

We’re excited to announce Secrets Store - Cloudflare’s new secrets management offering!

A secrets store does exactly what the name implies - it stores secrets. Secrets are variables that are used by developers that contain sensitive information - information that only authorized users and systems should have access to.

If you’re building an application, there are various types of secrets that you need to manage. Every system should be designed to have identity & authentication data that verifies some form of identity in order to grant access to a system or application. One example of this is API tokens for making read and write requests to a database. Failure to store these tokens securely could lead to unauthorized access of information - intentional or accidental.

The stakes with secret’s management are high. Every gap in the storage of these values has potential to lead to a data leak or compromise. A security administrator’s worst nightmare.

Developers are primarily focused on creating applications, they want to build quickly, they want their system to be performant, and they want it to scale. For them, secrets management is about ease of use, performance, and reliability. On the other hand, security administrators are tasked Continue reading

Out now! Auto-renew TLS certifications with DCV Delegation

To get a TLS certificate issued, the requesting party must prove that they own the domain through a process called Domain Control Validation (DCV). As industry wide standards have evolved to enhance security measures, this process has become manual for Cloudflare customers that manage their DNS externally. Today, we’re excited to announce DCV Delegation — a feature that gives all customers the ability offload the DCV process to Cloudflare, so that all certificates can be auto-renewed without the management overhead.

Security is of utmost importance when it comes to managing web traffic, and one of the most critical aspects of security is ensuring that your application always has a TLS certificate that’s valid and up-to-date. Renewing TLS certificates can be an arduous and time-consuming task, especially as the recommended certificate lifecycle continues to gradually decrease, causing certificates to be renewed more frequently. Failure to get a certificate renewed can result in downtime or insecure connection which can lead to revenue decrease, mis-trust with your customers, and a management nightmare for your Ops team.

Every time a certificate is renewed with a Certificate Authority (CA), the certificate needs to pass a check called Domain Control Validation (DCV). This is a process Continue reading

Protect your key server with Keyless SSL and Cloudflare Tunnel integration

Today, we’re excited to announce a big security enhancement to our Keyless SSL offering. Keyless SSL allows customers to store their private keys on their own hardware, while continuing to use Cloudflare’s proxy services. In the past, the configuration required customers to expose the location of their key server through a DNS record - something that is publicly queryable. Now, customers will be able to use our Cloudflare Tunnels product to send traffic to the key server through a secure channel, without publicly exposing it to the rest of the Internet.

A primer on Keyless SSL

Security has always been a critical aspect of online communication, especially when it comes to protecting sensitive information. Today, Cloudflare manages private keys for millions of domains which allows the data communicated by a client to stay secure and encrypted. While Cloudflare adopts the strictest controls to secure these keys, certain industries such as financial or medical services may have compliance requirements that prohibit the sharing of private keys.In the past, Cloudflare required customers to upload their private key in order for us to provide our L7 services. That was, until we built out Keyless SSL in 2014, a feature that allows customers Continue reading

A new, configurable and scalable version of Geo Key Manager, now available in Closed Beta

Today, traffic on the Internet stays encrypted through the use of public and private keys that encrypt the data as it's being transmitted. Cloudflare helps secure millions of websites by managing the encryption keys that keep this data protected. To provide lightning fast services, Cloudflare stores these keys on our fleet of data centers that spans more than 150 countries. However, some compliance regulations require that private keys are only stored in specific geographic locations.

In 2017, we introduced Geo Key Manager, a product that allows customers to store and manage the encryption keys for their domains in different geographic locations so that compliance regulations are met and that data remains secure. We launched the product a few months before General Data Protection Regulation (GDPR) went into effect and built it to support three regions: the US, the European Union (EU), and a set of our top tier data centers that employ the highest security measures. Since then, GDPR-like laws have quickly expanded and now, more than 15 countries have comparable data protection laws or regulations that include restrictions on data transfer across and/or data localization within a certain boundary.

At Cloudflare, we like to be prepared for the future. Continue reading

Bringing authentication and identification to Workers through Mutual TLS

We’re excited to announce that Workers will soon be able to send outbound requests through a mutually authenticated channel via mutual TLS authentication!

When making outbound requests from a Worker, TLS is always used on the server side, so that the client can validate that the information is being sent to the right destination. But in the same way, the server may want to authenticate the client to ensure that the request is coming from an authorized client. This two-way street of authentication is called Mutual TLS. In this blog, we’re going to talk through the importance of mutual TLS authentication, what it means to use mutual TLS within Workers, and how in a few months you’ll be able to use it to send information through an authenticated channel — adding a layer of security to your application!

mTLS between Cloudflare and an Origin

Mutual TLS authentication works by having a server validate the client certificate against a CA. If the validation passes then the server knows that it’s the right client and will let the request go through. If the validation fails or if a client certificate is not presented then the server can choose to drop the request.

Continue reading

Total TLS: one-click TLS for every hostname you have

Today, we’re excited to announce Total TLS — a one-click feature that will issue individual TLS certificates for every subdomain in our customer’s domains.

By default, all Cloudflare customers get a free, TLS certificate that covers the apex and wildcard (example.com, *.example.com) of their domain. Now, with Total TLS, customers can get additional coverage for all of their subdomains with just one-click! Once enabled, customers will no longer have to worry about insecure connection errors to subdomains not covered by their default TLS certificate because Total TLS will keep all the traffic bound to the subdomains encrypted.

A primer on Cloudflare’s TLS certificate offerings

Universal SSL — the “easy” option

In 2014, we announced Universal SSL — a free TLS certificate for every Cloudflare customer. Universal SSL was built to be a simple “one-size-fits-all” solution. For customers that use Cloudflare as their authoritative DNS provider, this certificate covers the apex and a wildcard e.g. example.com and *.example.com. While a Universal SSL certificate provides sufficient coverage for most, some customers have deeper subdomains like a.b.example.com for which they’d like TLS coverage. For those customers, we built Advanced Certificate Manager — a Continue reading

Zero Trust for SaaS: Deploying mTLS on custom hostnames

Cloudflare has a large base of Software-as-a-Service (SaaS) customers who manage thousands or millions of their customers’ domains that use their SaaS service. We have helped those SaaS providers grow by extending our infrastructure and services to their customer’s domains through a product called Cloudflare for SaaS. Today, we’re excited to give our SaaS providers a new tool that will help their customers add an extra layer of security: they can now enable mutual TLS authentication on their customer’s domains through our Access product.

Primer on Mutual TLS

When you connect to a website, you should see a lock icon in the address bar — that’s your browser telling you that you’re connecting to a website over a secure connection and that the website has a valid public TLS certificate. TLS certificates keep Internet traffic encrypted using a public/private key pair to encrypt and decrypt traffic. They also provide authentication, proving to clients that they are connecting to the correct server.

To make a secure connection, a TLS handshake needs to take place. During the handshake, the client and the server exchange cryptographic keys, the client authenticates the identity of the server, and both the client and the server generate Continue reading