DNS Same IP Cloudflare Proxy

[douglas7]

Hi,

I have my main website www. e domaim.com pointing to my server both using Cloudflare proxy, but if use a subdomain admin.domain.com pointing to the same server and Cloudflare proxy then it wont work saying?

This site can’t provide a secure connection

admin.domain.com uses an unsupported protocol.

ERR_SSL_VERSION_OR_CIPHER_MISMATCH

But if I turn the cloudflare proxy for this “A” DNS then it works fine… is there anyway to use more than one domain with cloudflare pointing to same server? I am using letsencrypt for SSL

[sdayman]

Cloudflare issues a cert for example.com and *.example.com. Anything within that range should work when proxied.

If you need more specific suggestions, please post the subdomain name in question.

[douglas7]

Hi, Thanks yah I just found they only cover one domain and one server if I need to use a domain and a subdomain domain.com and admin.domain.com to the same server they say one needs to be not orange proxied… if I want I will need to get the enterprise version…

[sdayman]

That doesn’t sound right. One Cloudflare account can accommodate a zone that includes a site on the apex domain, and any number of sites in a first level subdomain such as www.example.com or admin.example.com. They do not have to be on the same origin server.

[douglas7]

Hi, yes that is right, you can use as many *.domain.com as you want however if it will be in the same server you can only use the orange proxied with (www + domain.com) any extra admin.domain , app.domain you cannot use orange proxied if they are in the same server/ip only if you pay enterprise, if they are in another server (1 per server) all fine then you can use orange proxied

[michael]

@douglas7

you cannot use orange proxied if they are in the same server/ip only if you pay enterprise

This does not make sense. (At least to me).

On any plan you can have a large number of subdomains, and it does not matter if they all have the same or different origin IP addresses.

On an enterprise plan you can have a wildcard record set as , which you cannot have on other plan types. But on any plan you can create hundreds of hostnames, each of which can be set or as you desire or require.

[sdayman]

@douglas7

any extra admin.domain , app.domain you cannot use orange proxied if they are in the same server/ip

This is not true, and is not the source of your error.

[douglas7]

What I am reading wrong then? https://support.cloudflare.com/hc/en-us/articles/115003687931-Warning-about-exposing-your-origin-IP-address-via-DNS-records

“Wildcard “*” DNS records can only be proxied to Cloudflare for domains on the Enterprise plan. For all other plans, a wildcard DNS record reveals the origin IP.”

Not sure then why I can one get my main domain with orange proxy and the others I need to turn it off if that is in the same server

[sdayman]

Don’t use Wildcard DNS. You need a DNS record for every hostname that you want to proxy.

[douglas7]

That is not the way it is working for me… I am have 1000 domains with Orange cloud IF they are pointing to different servers/IP, if I have multiples domains/subdomains pointing to the same server it only works if they have orange proxy off…

[douglas7]

that is the only way I could get my domains working

Also I am using in SSl/TLS: Full Recommended by Cloudflare Encrypts end-to-end, using a self signed certificate on the server

if I turn one of those Grey clouds on I get the error: This site can’t provide a secure connection

dev.app.mydomain.com uses an unsupported protocol.

ERR_SSL_VERSION_OR_CIPHER_MISMATCH

and I have letsencrypt in all those domains in my servers

[sdayman]

@douglas7

dev.app.mydomain.com uses an unsupported protocol.

And there we go. Finally something we can work with. You originally said it was admin.domain.com.

Subdomain too deep

This tutorial covers a possible reason for the SSL_ERROR_NO_CYPHER_OVERLAP and ERR_SSL_VERSION_OR_CIPHER_MISMATCH errors (Firefox and Chrome respectively) when seen on a subdomain. The Cloudflare universal certificates cover example.com and *.example.com. This means that it covers any subdomain one level below the domain you signed up with. It will cover www.example.com and subdomain.example.com, as these are one level below the root domain, example.com. The certificate will not cover www.sub…

[douglas7]

hmmmm ok so that means it only covers up to OneName.MyDomain.com? so I can use
dev_app.mydomain.com or admin_dev_app.mydomain.com but not dev.app.mydomain.com either admin.dev_app.mydomain.com? is it?

[erictung]

Yes, unless you have Advanced Certificate Manager that allows you to deploy cert for dev.app.mydomain.com

[sdayman]

@douglas7

it only covers up to OneName.MyDomain.com

It’s more like covering sublevel.mydomain.com Not subsublevel.sublevel.mydomain.com