Overview of Keyless SSL
Keyless SSL lets sites use Cloudflare’s SSL service while retaining on-premise custody of their private keys. This is a brand-new security technology, developed by a team of cryptographers, systems engineers, and network specialists at Cloudflare.
The standard Cloudflare SSL service requires a customer to share their site’s SSL key with Cloudflare. Cloudflare takes extensive technical measures to safeguard customer key information. However, for some customers there are policy or technical obstacles preventing them from sharing their site’s SSL key with Cloudflare. This is why we are excited to introduce Keyless SSL.
Already a Cloudflare customer? Log In
Why Use Keyless SSL?
While most customers are comfortable with Cloudflare managing their private keys, some have unique security requirements making this impossible. Keyless SSL allows users to retain control of keys while still routing encrypted traffic through Cloudflare’s global network.
With Keyless SSL, for the first time ever, an organization can use a solution such as Cloudflare, that is infinitely scalable and infinitely elastic, without sharing their SSL key. Companies are able to get all of the benefits of the cloud (DDoS attack mitigation, load balancing, WAN optimization), without having to choose between encrypting web traffic or giving their SSL private keys to a 3rd party cloud provider.
How Keyless SSL Works
Note: Keyless SSL requires that Cloudflare decrypt, inspect and re-encrypt traffic for transmission back to a customer’s origin.
For non-SSL traffic through Cloudflare there are 3 parties: Client (e.g., web browser), Cloudflare edge node and Customer origin server.
For SSL traffic with Keyless SSL enabled, there is one additional endpoint involved in the initial SSL session creation, after which normal transmission resumes.
The request flow for Keyless SSL transactions is as follows:
1a. Client (e.g., web browser) connects to the Cloudflare edge node closest to the customer, via Anycast routing. The client sends a secret to the edge server encrypted with the site’s public key.
1b. The edge server contacts the key server, authenticating itself with a certificate. The edge server sends the encrypted secret to the key server to decrypt it. The key server returns the decrypted secret over an encrypted tunnel.
2a. Both client and server use the shared secret to establish a secure connection. Client (e.g., web browser) makes request over HTTPS for Cloudflare-powered customer resource.
2b. Cloudflare edge node (the Session Server) decrypts, inspects, and processes the original request.
For more details on Keyless SSL see this blog post.
Setting Up Cloudflare Is Easy
Set up a domain in less than 5 minutes. Keep your hosting provider. No code changes required.
Trusted by millions of Internet properties
