- Published on
Fixing Origin TLS Errors Permanently
- Authors
- Name
- Alex Lee
- Title
- CEO
- @alexjoelee
I think this is a story we can all relate to. You run into a need for a CDN, you sign up and get your site configured, but once you actually start sending traffic there, it's all SSL errors. Automatic settings in the dashboard didn't seem to work, there was no notification in the UI, and now your app is down. Rollback time.
Implementation Gotcha
This is probably one of the biggest issues that people have when they first start using a CDN. They aren't quite sure what type of TLS settings to use for their Origin server. Maybe it's not even their server, it could be some third-party "serverless" platform, and what's most important: they don't have an easy way to test each type of configuration. Until now!
Fixing Origin TLS Errors
We updated our UI and Origin TLS detection system with a high-utility feature: on-demand Origin testing. You can quickly and easily test your Origin's TLS responses and automatically select the best option, in order from "most secure" to "least secure," with live feedback in the UI.
Test 1: Full HTTPS
Just curl. Alright, it's a little more than that. When a test is initiated, we first send a request to your Origin for your website using full HTTPS with certificate verification. Certificate verification requires that the TLS certificate served by your origin server be signed by a Public Certificate Authority (CA.)
Test 2: HTTPS with self-signed certificates
We get that it's not always easy or convenient to manage a TLS cert. If the first HTTPS request fails, we try again using HTTPS but without certificate verification. This way, you can use self-signed multi-year certificates and all traffic will remain encrypted.
Test 3: HTTP
As a last resort, and perfectly acceptable for public, static content, we will test via HTTP.
We think this is a great feature that will make CDN deployment and troubleshooting much easier.
If you want a say in what we add to our platform next, head on over to feedback.skip2.net