platformsh / platformsh-docs

Platform.sh documentation. Templates available at https://github.com/platformsh-templates/
https://docs.platform.sh/
Creative Commons Attribution Share Alike 4.0 International
102 stars 331 forks source link

Cloudflare: SSL settings #3357

Open chadwcarlson opened 1 year ago

chadwcarlson commented 1 year ago

Where on docs.platform.sh should be changed?

What exactly should be updated?

SSL/TLS fails to provision when adding a custom domain to a project with Cloudflare configured.

It works iff, on the CloudFlare side, SSL/TLS encryption is set to full.

cloudflareSSLSettings

This is relevant during Pantheon migrations, where Pantheon has an option for "Full strict".

Additional context

No response

nlighteneddesign commented 1 year ago

Might be worth noting that if you have flexible or off set then the browser will say there are too many redirects happening. I suspect Cloudflare is requesting http and when platform redirects Cloudflare is redirecting back to http.

nlighteneddesign commented 1 year ago

I just tested, both Full and Full (strict) work on platformsh Off and Flexible result in infinite redirects.

ErriteEpticRikez commented 11 months ago

In some cases, when a user transfers from one provider to another and decides to stay with Cloudflare as their CDN of choice, it can cause some issues if older SSL settings are still being used.

The biggest example is if the Flexible encryption mode is enabled (as @nlighteneddesign said previously). It can cause a redirect loop when CloudFlare tries to reach to the origin via HTTP. By default, all routes create a redirect for HTTP to HTTPS. The issue will persist unless the user changes the encryption mode to full.

In Platform.sh support land we see this occasionally, but with upsun this could become more common. Can we try maybe adding more documentation to the Set up your Cloudflare CDN or somewhere more appropriate customers can find this solution? Maybe add a section for Too Many Redirect Errors?