cloudflare

Cloudflare Origin Server Certificate for IIS 10 Server on Windows Server 2016 to allow Full (strict) mode SSL/TLS encryption mode 8

14 January 2021 in Applications tagged certificate / cloudflare / iis / IIS 10 / Origin Server / server by Tux

Create a Certificate Request from your Windows Server

Open Internet Information Services (IIS) Manager from the Windows Server 2016 through Control Panel -> Administrative Tools
Select your server from the Connections and open Server Certificates

From the Server Certificates Actions select Create Certificate Request

Fill in the following form with your details:

Common name: [your domain]
Organization: [your organization name]
etc.

Set the settings for the Cryptographic service provider of the certificate, the bigger the length of the certificate the better the security but it makes the server slower.

Specify the filename of the txt file where you will save the certificate request

Create the certificate from Cloudflare using your own certificate request that you created from your Windows Server

Open your Cloudflare account, select your domain, open SSL/TLS tab and click on Origin Server in order to create the certificate

Select the option ‘I have my own private key and CSR’ where you will Copy-Paste the certificate you saved on the txt file from your Windows Server, fill in the hostnames, select the expiration years and press Next

Copy-Paste in PEM key format the certificate in a text file and save the file

Add the public certificate from Cloudflare at your Windows Server

Copy the file with the PEM certificate from Cloudflare at your Windows Server
Select ‘Complete Certificate Request’ from the IIS Manager Server Certificates Actions

Select the PEM certificate you copied at the server and add a friendly name (e.g. the domain it covers and the expiration date of it):

The certificate will appear at the list of the Server Certificates with the Friendly name you added at the form before

Import Cloudflare Origin CA root certificate at your Windows server

Copy the Cloudflare Origin CA — RSA Root certificate from Cloudflare website, save to a file and transfer it to your Windows Server
Open the Certificates Microsoft Management Console (MMC) snap-in by typing mmc.exe at the command prompt (or at the run dialog that you can open by pressing the buttons Win+R)
On the File menu, select Add/Remove Snap-in

In the Add or Remove Snap-ins dialog box, select Certificates snap-in in the Available snap-ins list, click Add, and then select OK

In the Certificates snap-in dialog-box, select Computer account, and then select Next

In the Select computer dialog box, click on Finish

In the Add or Remove Snap-ins dialog box, select OK

In the Certificates MMC snap-in, expand Certificates, right-click Intermediate Certification Authorities, point to All Tasks, and then select Import

In the Certificate Import Wizard, select Next

In the File to Import page, select the file with the Cloudflare origin CA root certificate you saved before, and then select Next

Select Next at the Certificate Import Wizard

Select Finish at the Certificate Import Wizard

The certificate will appear at the Certificates list

Use the newly created server origin certificate from Cloudflare for your website

Select Bindings from the IIS Manager Web Site Actions

Select the https binding and click Edit. If you do not have an https binding, press Add... to create one like in the second screen down

At the SSL certificate dropdown list Select the new certificate and press OK

Force your website domain to pass through Cloudflare

Open your Cloudflare account, select your domain, go to DNS option and change the Proxy status for your website from DNS only to Proxied by click it

Enable Cloudflare full (strict) SSL TLS encryption mode in the SSL/TLS tab

Ubuntu SSHD listen to multiple ports

23 April 2018 in GNU/Linux tagged cloudflare / mulitple ports / server / ssh / sshd / sshd_config / ubuntu by Tux

Recently, we’ve setup an Ubuntu server behind CloudFlare that needed to listen for SSH connections.
Unfortunately, CloudFlare does not allow connections to the default SSH port which is 22.
So, to achieve what it was needed we either had to change the port that the SSH service was listening to or add an additional port.
We decided to go with the option of listening to multiple ports for SSH connections, this way users that were also behind the CloudFlare CDN could still continue to use their SSH clients without being forced to define the connection port manually.

The port listening setting is available in /etc/ssh/sshd_config, using sudo we edited the file with a text editor and searched for the following lines:

# What ports, IPs and protocols we listen for
Port 22

Right after the line that contains Port 22, we added another line for the new port (to see the list of all available open ports on CloudFlare, check this post)

And the file became as follows:

# What ports, IPs and protocols we listen for
Port 22
Port 2053

Afterwards, we restarted the SSHD service to apply the changes by executing the following command by using sudo:


systemctl restart ssh;

CloudFlare does not allow port 22 (usual SSH port) on domain 3

15 March 2018 in Applications tagged cloudflare / DNS / port / server / ssh / ubuntu by Tux

When you try to connect via ssh on a domain for which you are using CloudFlare as a HTTP proxy, you will get the following error:

$ ssh [email protected]
 ssh_exchange_identification: Connection closed by remote host

You have a few options to resolve for this issue:

Either connect directly to the IP of the machine.
Or, setup a CNAME record with no HTTP proxy for the SSH (so that you do not need to remember the IP).
This solution does not offer any additional benefits than connecting directly to the IP of the server.
To do that, you need to visit the configure DNS page for your site: e.g. https://www.cloudflare.com/a/dns/example.com,
then create the CNAME named ssh, use as target your domain (e.g. example.com) and disable HTTP proxy by clicking on the orange cloud and making it gray before pressing the Add Record button.

Then, you will be able to connect via ssh [email protected].
Last solution but not least is configuring your server to listen for SSH on one of the ports of CloudFlare that are open.
When this post was written, the following ports were available/open for any site in CloudFlare:
For requests made via HTTP:
```
80
8080
8880
2052
2082
2086
2095
```
For requests made via HTTPS:
```
443
2053
2083
2087
2096
8443
```
At the time, we were using an Ubuntu GNU/Linux server, to instruct Ubuntu SSHD to listen to multiple ports we edited the file /etc/ssh/sshd_config and right after the lines:
```
# What ports, IPs and protocols we listen for
Port 22
```
we added another line with the new port we wanted to use:
```
# What ports, IPs and protocols we listen for
Port 22
Port 2053
```
After restarting the service
service ssh restart;
we were able to connect to our page as follows:
ssh -p 2053 [email protected];

Cannot verify domain with Yandex when domain is behind CloudFlare 2

14 March 2018 in HowTos tagged cloudflare / cname / domain / yandex by Tux

Recently we were trying to verify the ownership of a domain through yandex. We tried the CNAME approach which would be more universal and so we added a new CNAME record in the DNS configuration in CloudFlare.

The record had the following configuration:

Type: CNAME
Name: yamail-dd63c3831dbd
Value: mail.yandex.com
TTL: Automatic
Status: DNS and HTTP proxy (CDN)

We tried several times the verify domain button in https://domain.yandex.com/domain/example.com/ but it kept on failing saying that the CNAME record was not found. Only after we disabled the DNS and HTTP proxy (CDN) did it work.

So in the end, the properly working record was as follows:

Type: CNAME
Name: yamail-dd63c3831dbd
Value: mail.yandex.com
TTL: Automatic
Status: DNS Only

Bytefreaks.net – a place for hacks