Clarify Keyless SSL certificates and add DNS-only key server note#31788
Open
baubuchon-cf wants to merge 2 commits into
Open
Clarify Keyless SSL certificates and add DNS-only key server note#31788baubuchon-cf wants to merge 2 commits into
baubuchon-cf wants to merge 2 commits into
Conversation
…r note Adds a "Certificates used in Keyless SSL" section to the Public DNS setup page distinguishing the edge (Keyless SSL) certificate from the key server authentication certificate, with a caution against adding the key server hostname to the public edge cert SAN (unnecessary; leaks internal hostnamesinto CT logs). Also adds a note that a key server hostname on a Cloudflare zone must use a DNS-only (grey-cloud) record to avoid NXDOMAIN handshake failures.
Contributor
ReviewCode ReviewThis code review is in beta and may not always be helpful — use your judgment. Warnings (1)
ConventionsChecks PR title, description, and redirect checklist. No convention issues found. Style Guide ReviewNo style-guide issues found. RedirectsNo missing redirect entries found. CommandsOnly codeowners can run commands. Post a comment with the command to trigger it.
|
Contributor
|
This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:
|
![ask-bonk[bot]](https://avatars.githubusercontent.com/in/2454580?s=60&v=4){kind=small}
|
|
||
| ## Certificates used in Keyless SSL | ||
|
|
||
| Keyless SSL involves **two different certificates**. Confusing them is the most common setup error. |
Contributor
There was a problem hiding this comment.
Define the acronym before it appears in the table below:
Suggested change
| Keyless SSL involves **two different certificates**. Confusing them is the most common setup error. | |
| Keyless SSL involves **two different certificates**, each with a different Subject Alternative Name (SAN). Confusing them is the most common setup error. |
|
|
||
| Keyless SSL involves **two different certificates**. Confusing them is the most common setup error. | ||
|
|
||
| | Certificate | What it is | SAN should contain | |
Contributor
There was a problem hiding this comment.
Expand the acronym for accessibility:
Suggested change
| | Certificate | What it is | SAN should contain | | |
| | Certificate | What it is | Subject Alternative Name (SAN) should contain | |
Contributor
|
Reviewed PR #31788 and posted suggestions. Here's a summary: Labels applied
What the PR changes
Issues flagged
No build-breaking issues (valid frontmatter, no unescaped MDX characters, components already imported). |
Co-authored-by: ask-bonk[bot] <249159057+ask-bonk[bot]@users.noreply.github.com>
Collaborator
Author
|
/full-review |
Contributor
|
Preview URL: https://794a64ea.preview.developers.cloudflare.com Files with changes (up to 15) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Improves the Keyless SSL "Public DNS" setup page:
NXDOMAINand the handshake fails.