Get Free TLS certificate with Cloudflare
1. Hosting your domain on Cloudflare (Enable CDN)#
client <----tls-1----> cloudflare <----tls-2----> your server
Note: You cannot login your server with
ssh user@your_domain
any more after enabling Cloudflare. You need to login withssh user@your_ip
. Cause the Cloudflare acts as a reverse proxy, it only forwards the http/https traffic to your server, and only on some specific ports.
There are two steps to add your domain to Cloudflare:
- Add your domain to Cloudflare
- Create and install TLS certificate to your server
Cloudflare does this by serving as a reverse proxy for your web traffic. Actually, Clooudflare achieves this by using its CDN service, which caches your website’s static content and serves it to your visitors from the nearest Cloudflare data center. Refer to our Load Balancing reference architecture to learn more about advanced ways to forward traffic to your origins, as well as our CDN reference architecture to learn more about how Cloudflare processes and optimizes your web traffic.
1.1. Add your domain to Cloudflare#
Go to this website: https://dash.cloudflare.com/
And you will get instructions for updating your nameserver of your domain. After change your nameserver, waite about one hour, your site will be active on Cloudflare. Then you can choose the TLS encryption mode:
Note: choose
full mode
, don’t useflexbile mode
, otherwise you probably would get ERR_TOO_MANY_REDIRECTS when access your website.
1.2. Install TLS certificate#
The generated two files cert.pem
and cert.key
is used for encryption between your server and Cloudflare.
You can use these two file like this:
...
func main() {
http.HandleFunc("/hello", HelloServer)
err := http.ListenAndServeTLS(":443", "./conf/cert.pem", "./conf/cert.key", nil)
if err != nil {
log.Fatal("ListenAndServe: ", err)
}
}
Note: don’t add the keep-alive header when handle request on your server, otherwise you may get a 520 error when you access your website on browser:
Error 520: Web server is returning an unknown error
w.Header().Set("Connection", "Keep-Alive") w.Header().Set("Keep-Alive", "timeout=2, max=1000")
Learn more: https://luyuhuang.tech/2020/06/03/cloudflare-free-https.html
After config this, the DNS needs time to take effect (you change the nameservers of your domain to Cloudfalre from the defatult nameservers, this needs time to take effect)
If there still no HTTPS connection but the cloudflare displays your website is active on their service, you may try to check if your server is listening on 443 port and try to flush the DNS cache of your client computer (chrome + system DNS cache). Learn more: DNS Concepts (NameServer(NS), DNS Records and Caching) - David’s Blog
BTW, you can check if your domain is proxied by the Cloudflare with nslookup command, which will get the A Record
by default (IPv4) address of your domain, but in this case, with Cloudfalre proxy, you should get the ip of Cloudfalre Name Server.
❯ nslookup shaowenzhu.top
Non-authoritative answer:
Name: shaowenzhu.top
Address: 172.67.171.207 # not my domain's real ip, it's Cloudfalre
Name: shaowenzhu.top
Address: 104.21.47.185 # not my domain's real ip, it's Cloudfalre
Learn more: Add a site · Cloudflare Fundamentals docs
2. Change A record#
If you changed a vps, all you need to do is to change the A record of your domain on Cloudflare, you don’t need to change the A record on your domain register website.
Cloudflare serves as a reverse proxy, directing all traffic for the specified proxied domain to the target IP address.
3. Allow custom port#
The default port of https is 443. If you want to use other ports, you need to allow them with firewall first on your server.
Cloudflare only allows the following HTTPS ports:
443 2053 2083 2087 2096 8443
Very easy, you don’t need to do anything on Cloudflare, just allow the port on your server. Then you can access your website with https://your_domain:port
. And your traffic will be encrypted by Cloudflare.
Learn more:
How to allow custom port - Website, Application, Performance / Security - Cloudflare Community
Network ports · Cloudflare Fundamentals docs
Learn more about CDN:
What is a content delivery network (CDN)? | How do CDNs work? | Cloudflare