# Discourse & Cloudflare
**URL:** https://meta.discourse.org/t/discourse-cloudflare/236677
**Category:** Self-hosting
**Created:** [August 19, 2022, 7:14pm UTC](https://meta.discourse.org/t/discourse-cloudflare/236677 "2022-08-19T19:14:16Z")
**Posts on this page:** 10
**Page:** 3
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [August 27, 2022, 3:58pm UTC](https://meta.discourse.org/t/discourse-cloudflare/236677/41 "2022-08-27T15:58:40Z")
> [@epskpsdsc](#):
>
> always access the webserver for the HTTP-01 challenge through HTTPS, even with the Cloudflare Universal SSL cert in front of it, so one wouldn’t have to wait with turning on Orange Cloud until after LE cert is issued.
Yes, HTTP-01 challenge works in conjunction with Cloudflare in “orange cloud” mode. But it does not work over HTTPS, the HTTP-01 challenge only works over port 80, and:
Many people running Cloudflare set Cloudflare to automatically redirect HTTP to HTTPS, and **that** makes port 80 on the origin server unavailable, and **that** prevents HTTP-01 challenges from working.
So if you don’t enable those redirects, then it will work.
> [@Stephen](#):
>
> Let’s Encrypt will fail if Cloudflare is enabled before the intial cert is issued.
So strictly speaking this is untrue.
Let’s Encrypt _will_ fail if Cloudflare is set to redirect traffic on port 80 before it reaches the origin server.
---
### Author:  [@epskpsdsc](https://meta.discourse.org/u/epskpsdsc)
#### Post date: [August 27, 2022, 4:46pm UTC](https://meta.discourse.org/t/discourse-cloudflare/236677/42 "2022-08-27T16:46:50Z")
I agree, however because IT security is now more present than ever and people begin to work with Zero Trust products more, which CF Tunnel is a part of, we will and should see an increase of utilization of this kind of technology, that’s why I brought it up.
---
### Author:  [@epskpsdsc](https://meta.discourse.org/u/epskpsdsc)
#### Post date: [August 27, 2022, 5:00pm UTC](https://meta.discourse.org/t/discourse-cloudflare/236677/43 "2022-08-27T17:00:27Z")
I think you misunderstood how LE’s HTTP-01 challenge works.
It looks for the token certbot or other variant of LE client put, most of the time, into the .well-known subfolder of the webserver.
But it isn’t hardcoded to start the request on port 80, ignore any HTTP code redirects and fail outright if it can’t find the token.
The HTTP-01 challenge is able to follow HTTP redirects (so 301 and 302) and is therefore able to read the .well-known folder through 443 and HTTPS.
And the reason it works for Cloudflare Universal SSL WITH Redirect (and Cloudflare Tunnel) is that Cloudflare answers in place of the webserver on Port 80, redirects the request to 443, where LE can read the token and the CA can issue the cert.
High-Level diagram of the flow:
Certbot starts HTTP-01
→ POSTs cert request to CA and puts token into .well-known
→ CA starts GET for Token on FQDN port 80
→ CF redirects to port 443 and secures the request with its Universal SSL cert
→ Request is forwarded to the webserver itself (through CF Tunnel or direct)
→ CA is able to GET the token in .well-known because port 443 is able to present the token the same way HTTP and port 80 would
→ CA POSTs the RAW cert data and Certbot creates the files
---
### Author:  [@Richie](https://meta.discourse.org/u/Richie)
#### Post date: [August 27, 2022, 6:25pm UTC](https://meta.discourse.org/t/discourse-cloudflare/236677/44 "2022-08-27T18:25:09Z")
I started [a topic](https://meta.discourse.org/t/looking-for-a-recent-cloudflare-how-to-guide/220813) back in March looking for more recent details or guides on how to implement Cloudflare.
I’m still looking for one 🙂
I use Cloudfront as a CDN but would like to add the ddos protection that Cloudflare bring to the table. We get hammered a lot 😕
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [August 27, 2022, 9:04pm UTC](https://meta.discourse.org/t/discourse-cloudflare/236677/45 "2022-08-27T21:04:51Z")
> [@epskpsdsc](#):
>
> I think you misunderstood how LE’s HTTP-01 challenge works.
I think I understand it pretty well. You are right, it can be redirected to HTTPS, but it depends on Cloudflare settings and webserver configuration whether that will work or not, since initially there will be no valid certificate on the origin server.
> [@epskpsdsc](#):
>
> But it isn’t hardcoded to start the request on port 80
Yes, they can be redirected to a different port, but HTTP-01 challenges **must** always _start_ on port 80.
See [Challenge Types - Let's Encrypt](https://letsencrypt.org/docs/challenge-types/)
> The HTTP-01 challenge can only be done on port 80. Allowing clients to specify arbitrary ports would make the challenge less secure, and so it is not allowed by the ACME standard.
---
### Author:  [@epskpsdsc](https://meta.discourse.org/u/epskpsdsc)
#### Post date: [August 27, 2022, 9:38pm UTC](https://meta.discourse.org/t/discourse-cloudflare/236677/46 "2022-08-27T21:38:34Z")
> [@Richard - Communiteq](#):
>
> I think I understand it pretty well. You are right, it can be redirected to HTTPS, but it depends on Cloudflare settings and webserver configuration whether that will work or not, since initially there will be no valid certificate on the origin server.
I agree, I just pointed out your inaccuracy that it will straight up **never** work.
* * *
> [@Richard - Communiteq](#):
>
> > [@epskpsdsc](#):
> >
> > But it isn’t hardcoded to start the request on port 80
>
> Yes, they can be redirected to a different port, but HTTP-01 challenges **must** always _start_ on port 80.
The quoting of my sentence you have executed here is quite evil since it suggests the wrong circumstance of discussion and implies another meaning. My full sentence was
> [@epskpsdsc](#):
>
> But it isn’t hardcoded to start the request on port 80, ignore any HTTP code redirects and fail outright if it can’t find the token.
and the important part of my sentence was the combination of “hardcoded to start the request on port 80” AND “ignore any HTTP redirect” AND “fail outright”, since you said
> [@RGJ](#):
>
> Many people running Cloudflare set Cloudflare to automatically redirect HTTP to HTTPS, and **that** makes port 80 on the origin server unavailable, and **that** prevents HTTP-01 challenges from working.
and this implies that the reason of the HTTP-01 challenge failing is the redirect alone, which is not true.
Also, strictly speaking, a redirect does not make port 80 “unavailable”.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [August 27, 2022, 10:30pm UTC](https://meta.discourse.org/t/discourse-cloudflare/236677/47 "2022-08-27T22:30:06Z")
> [@epskpsdsc](#):
>
> The quoting of my sentence you have executed here is quite evil
No evil meant or intended.
> [@epskpsdsc](#):
>
> Also, strictly speaking, a redirect does not make port 80 “unavailable”.
It makes port 80 of the origin server unavailable for all traffic that is directed at the hostname.
I don’t like the current tone of the conversation in this topic, so I’m unwatching it.
My opinion on Cloudflare in combination with Discourse can be summarized as “many people are apparently unable to configure it correctly so in general I would recommend against enabling it. If you want to use it for DDoS protection, then I would recommend enabling it with very specific settings only.”
---
### Author:  [@Ed\_S](https://meta.discourse.org/u/Ed_S)
#### Post date: [August 28, 2022, 6:21am UTC](https://meta.discourse.org/t/discourse-cloudflare/236677/48 "2022-08-28T06:21:39Z")
> [@RGJ](#):
>
> My opinion on Cloudflare in combination with Discourse can be summarized as “many people are apparently unable to configure it correctly so in general I would recommend against enabling it. If you want to use it for DDoS protection, then I would recommend enabling it with very specific settings only.”
That’s a clear statement, thanks.
---
### Author:  [@Jagster](https://meta.discourse.org/u/Jagster)
#### Post date: [August 28, 2022, 7:24am UTC](https://meta.discourse.org/t/discourse-cloudflare/236677/49 "2022-08-28T07:24:41Z")
This can be another stupid question, but because I’m serving only finnish audience I don’t see any reason to use Cloudflare, so I konw it only by reputation.
But if its only benefit is stopping DDoS, and DDoS mostly means just too many calls made by
- useless SEO-crawlers
- another bots made by script kiddies
then why not use Nginx front of Discourse and stop known user agents there? When combined with Fail2ban that would reduce load something like 90 % (sure stetson statistic, but a lot anyway).
---
### Author:  [@Simen\_Will](https://meta.discourse.org/u/Simen_Will)
#### Post date: [January 26, 2024, 7:07am UTC](https://meta.discourse.org/t/discourse-cloudflare/236677/50 "2024-01-26T07:07:36Z")
This discussion is very valuable. For a Chinese website administrator, Could Flare means whether Chinese users can normally exchange data with the outside world. I did a test some time ago. If you don’t use Orange Cloud and access servers in other countries from China, the network jitter will be very serious. The evil thing is that running a forum in China is subject to strict censorship. Even though I was doing a non-political forum, I still suffered. We must assume that the server of the website is located outside of China. So, if I create a forum using Discourse, I have to consider whether it can use Could Flare.
[Previous page](https://meta.discourse.org/t/discourse-cloudflare/236677.md?page=2)