2

My setup is as follows:

  • Dedicated server (Linux) with dynamic IP address
  • NO-IP domain name
  • domain name
  • When I want to access my system (server), I access my domain, which redirects me to my NO-IP domain which, in turn, redirects to a current IP address of the server.

I'd like to add encryption and DDOS protection to my system so I thought about setting up an SSL certificate and introducing CloudFlare services.

It is easy to setup CloudFlare, but I am really not sure if it's possible to setup up SSL via Let's Encrypt with the scheme I've created. I became lost in various types of SSL certificates (what exactly do I need?) considering several redirection that would occur.

The way I understood it is if I introduce SSL certificate from CloudFlare, I would only encrypt traffic from a user to CloudFlare but not from CloudFlare to the server. Am I right?

If I am going to get Let's Encrypt certificate, I would need to install it on my server, but how do I get one if there are several redirects involved and I have a dynamic IP address? How would it work with CloudFlare?

  • A dynamic IP address indicates to me that you are serving your site off your home computer. Correct? If so, how are you planning to renew your Let's Encrypt certificate. It took me quite a bit of work to get certbot working reliably from a cron job on my own servers. Setting up certbot on your home computer to auto-renew your certificates isn't all that easy. LetsEncrypt is best when your host does the renewing work for you. – Stephen Ostermiller Sep 4 '18 at 9:37
  • That is exactly why I've asked my question. – CorellianAle Sep 4 '18 at 9:38
  • You can do what you want, but it is difficult. Rather than using cloudflare I'd recommend getting hosting somewhere other than at home. – Stephen Ostermiller Sep 4 '18 at 9:42
  • Server is not located at my home, it's more about the fact that static IP costs too much because ISP has monopoly here and VPS is not worth it because the server is really powerful and failsafe. – CorellianAle Sep 4 '18 at 11:25
  • 1
    @CorellianAle If you redirect to another domain or IP address, you'll break the Proxy connection with CloudFlare (i.e., it will no longer be in the mix). You'll also need to reissue the Let's Encrypt certificate using the current dynamic IP address each time it changes. If you're limited to using a local server with a dynamic IP address, I'd suggest using CloudFlare with a Flexible SSL proxying the NO-IP domain name (if they allow that), and a separate CloudFlare website/domain with Flexible SSL to your domain name. Then you'll be redirecting from HTTPS to HTTPS... – dan Sep 5 '18 at 6:12
1

You can create a self-signed certificate on the server, and use that with CF's Full, but not Full (strict) SSL setting. I don't know if you'd have to create a new self-signed certificate each time the IP changes though.

https://blog.cloudflare.com/origin-server-connection-security-with-universal-ssl/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.