FlareCTL fetch domains that are switched to FULL SSL

Developers API
1

For Workers & Pages, what is the name of the domain?

psbrickwork.com

What is the issue or error you’re encountering

FlareCTL fetch domains that are switched to FULL SSL

What steps have you taken to resolve the issue?

Hi,
Sorry I’m not a dev, but a sysadmin. I have 700+ domains in a cloudflare account. Recently it starting for-switching to full Secure SSL while I’m using Flexible on maximum websites. I can’t seem to workout a way to stop this Disable Automatic SSL/TLS Upgrader, so have been manually reverting them to Flexible which is painfully long and hard process.

Can someone help me construct a flarectl CLI query that I can use to:

  1. Fetch which domains are NOT using Flexible SSL (are set to Full)
  2. Change them to FLEXIBLE SSL

Many thanks

What are the steps to reproduce the issue?

N/A

2

700+ domains using flexible :facepalm:

Or you could… and I’m just spitballing here…. Install a certificate on the origin server.

5 Likes
3

Yes 700+ domains… however only 300 odd are working, those are small static pages microsites split across 4 different servers.
Would you pls guide me more what you mean by installing a certificate on origin server? Will configuring this single certificate work for all domains hosted on this server? If I add more sites, will they be auto-added?

4

Whoever the admin of the server is, they should be adding an origin certificate from Let’s Encrypt, etc., every time they add a site.

2 Likes
5

Sorry, the whole point of this post is to have Cloudflare handle SSL termination without the sysadmin having to use any SSL/https configured on server side. I know how to issue Let’s Encrypt SSL but thats not what I want.

I know its not as safe… however, there is nothing on the sites that can be compromised, just a few static HTML pages. The setup has been working fine for half a decade, just that Cloudflare is enforcing SSL upgrades to FULL and its been a nightmare to revert them back manually one by one.

If I can just revert them back to Flexible programmatically, that’ll save a bunch of time.

6

What Cloudflare chooses to do… you and I have no control over.

But you can avoid all that “nightmare” with max 30mins of server config.

1 Like
8

Install a Cloudflare origin cert. If you are using Full as the SSL setting you are done.

Regardless of what the site is doing there’s a minimum level of diligence required. Flexible ain’t it.

2 Likes
9

Rather fetch all where Automatic SSL feature is enabled, if yes then disable Automatic and set SSL to the Flexible SSL if it’s set to something else? :thinking:

You’re familiar and need a bash script for this or? :thinking:

10

That sounds right… Yes I’m familiar and good with bash scripts, if you can send me the exact ‘cloudflare api call’ to achieve this? I guess it’ll be in linear fashion, fetch all IDs of the domains in zone, then parse those IDs for SSL status, so on?

If you already have this scripted, I’ll be thankful for help.

11

If I go this route, when I add new domains to my cloudflare account, that origin certificate will work with those new domains or do I have to re-issue it and install again on my server ?