CloudFlare whacks me in with the porn sites

by Andrew Martin

A validation of CloudFlare's free one-click Flexible SSL service reveals some unsavoury neighbours on the shared certificate they alot to this site. From sslshopper:

Common name: sni29282.cloudflaressl.com
SANs: sni29282.cloudflaressl.com, *.askporno.com, *.binarysludge.com, *.dzej.eu, *.grem.eu, *.hmtransportation.com, *.joowaal.com, *.kuwaitinfo.info, *.le-foie-gras.eu, *.mnmjewellery.com, *.mobxnxx.com, *.philippines2050.com, *.pornfax.com, *.pornhideaway.com, *.pornmovies101.com, *.shokweb.com, *.tennistemptation.lt, *.tennistt.lt, *.the-porn-videos.com, *.timenewroman.com, *.tutoringunlimited.com, askporno.com, binarysludge.com, dzej.eu, grem.eu, hmtransportation.com, joowaal.com, kuwaitinfo.info, le-foie-gras.eu, mnmjewellery.com, mobxnxx.com, philippines2050.com, pornfax.com, pornhideaway.com, pornmovies101.com, shokweb.com, tennistemptation.lt, tennistt.lt, the-porn-videos.com, timenewroman.com, tutoringunlimited.com
Valid from January 27, 2015 to September 30, 2015
Serial Number: 3cf48631db03ffa5285ec805c3545837
Signature Algorithm: ecdsa-with-SHA256
Issuer: COMODO ECC Domain Validation Secure Server CA 2

There are a number of problems with CloudFlare's SSL implementation - the most serious of which is breaking the user's learned belief in the chain of trust. By terminating HTTPS traffic at their servers and proxying them over plain HTTP to the target server, the trust model of the internet is severly compromised.

There is something to be said for the advantage of a semi-encrypted connection adding more security that none at all, but the price is a high one to pay.