Overview of Keyless SSL

Keyless SSL lets sites use Cloudflare’s SSL service while retaining on-premise custody of their private keys. This is a brand-new security technology, developed by a team of cryptographers, systems engineers, and network specialists at Cloudflare.

The standard Cloudflare SSL service requires a customer to share their site’s SSL key with Cloudflare. Cloudflare takes extensive technical measures to safeguard customer key information. However, for some customers there are policy or technical obstacles preventing them from sharing their site’s SSL key with Cloudflare. This is why we are excited to introduce Keyless SSL.

Contact Our Team

Why Use Keyless SSL?

While most customers are comfortable with Cloudflare managing their private keys, some have unique security requirements making this impossible. Keyless SSL allows users to retain control of keys while still routing encrypted traffic through Cloudflare’s global network.

With Keyless SSL, for the first time ever, an organization can use a solution such as Cloudflare, that is infinitely scalable and infinitely elastic, without sharing their SSL key. Companies are able to get all of the benefits of the cloud (DDoS attack mitigation, load balancing, WAN optimization), without having to choose between encrypting web traffic or giving their SSL private keys to a 3rd party cloud provider.

How Keyless SSL Works

Note: Keyless SSL requires that Cloudflare decrypt, inspect and re-encrypt traffic for transmission back to a customer’s origin.

For non-SSL traffic through Cloudflare there are 3 parties: Client (e.g., web browser), Cloudflare edge node and Customer origin server.

For SSL traffic with Keyless SSL enabled, there is one additional endpoint involved in the initial SSL session creation, after which normal transmission resumes.

The request flow for Keyless SSL transactions is as follows:

1a. Client (e.g., web browser) connects to the Cloudflare edge node closest to the customer, via Anycast routing. The client sends a secret to the edge server encrypted with the site’s public key.

1b. The edge server contacts the key server, authenticating itself with a certificate. The edge server sends the encrypted secret to the key server to decrypt it. The key server returns the decrypted secret over an encrypted tunnel.

2a. Both client and server use the shared secret to establish a secure connection. Client (e.g., web browser) makes request over HTTPS for Cloudflare-powered customer resource.

2b. Cloudflare edge node (the Session Server) decrypts, inspects, and processes the original request.

The authentication step happens only once per session; additional requests within the session do not require the extra check to the Key Server. The customer can modify the default SSL session TTL (time to live) from 18 hours to as low as 5 minutes or as high as 48 hours.

For more details on Keyless SSL see this blog post.

Third Party Security Audits

Cloudflare’s Keyless SSL cryptography has been reviewed by iSEC Partners in conjunction with Matasano Security, and each part of NCC Group — world leaders in application security and cryptographic review.

How to Get Access to Keyless SSL

Keyless SSL will initially be available only to customers on the Enterprise plan. For more information on the Enterprise plan and Keyless SSL, contact our sales team.