Free SSL Cert from CloudFlare and SSLCert.com Cert Spotter

ssl

#1

I have a couple of domains that are using the free CloudFlare SSL cert configured as Flexible SSL. Connections to the domain is fine. However when I signed up for a free account on SSLmate.com and used their fre CertSpotter option all of the domains returned 72 unexpired certs that were issued for the domains in question as well as a whole bunch of other domains that are not mine. The Issue date rangers from 2018-05-05 with an expiration of 2018-11-11 to issuance date of 2017-11-04 with expiration date of 2018-05-13. All of these certs were issued via Comodo.

I can see using wildcard certs for a bunch of domains that are using Cloudflare but why are there so many apparent valid SSL certs according to SSLmate.com and their CertSpotter?


#2

I edited your links. SSLCert probably isn’t the site you were using.

The Free SSL certs Cloudflare uses are blanket certificates for a whole bunch of domains on your Cloudflare server. My experience is that certificate will update quite often as domains are added and removed from that certificate. That’s probably what’s causing so many certificates to show up, as they’re re-issued before they expire.


#3

Cloudflare’s free tier of certificates are shared across multiple
customers, a new certificate is issued whenever they need to add/remove
hostnames.


#4

This topic was automatically closed after 14 days. New replies are no longer allowed.