SSL Cloudflare SSL questions..

For SSL, it works but I have some questions which I can't really find a definite answer after searching on the net and reading the CentminMOD docs and posts.

I'm using free Cloudflare proxied DNS (orange cloud) and vurtr CENTOS 7.

I roughly list the follow things (not really a complete list) I've done in case some people are interested.

1) I installed the SSL vhost in centmin menu 2.

2) I got http forwarded to https by the setting in Cloudflare and also uncommented the following line in the myserver.ssl.conf (I renamed myserver.conf to myserver.conf-disabled):

Code (Text):

 server {
       listen   80;
       server_name myserver.com www.myserver.com;
       return 301 https://$server_name$request_uri;
 }

3) I use FULL (strict) SSL in Cloudflare, so I generate the free crt and key files from their website. Then I cat them to the respective crt and key files in /usr/local/ngnix/conf/ssl/myserver/

It works.

My questions:

1) What's the file dhparam.pem in /usr/local/ngnix/conf/ssl/myserver/ for? I found that I could actually delete it and also deleted the corresponding line in myserver.ssl.conf. Then ngxrestart, it still works.

---

2) Why can't I get a pretty green encryption lock for my website? I understand it means I got a mixed kind of website - SSL and non-SSL. But I've forwarded all the http to https. The website content is the default one. How do I get a green lock?

3) Now my SSL cert is issued by Cloudflare and issued to sni.cloudflaressl.com which I guess is shared by many other websites.

So if I want to have it issued to myserver.com, I need to purchase a cert from "trusted CA" ($5/month for Cloudflare) or get a cert from Letsencrypt for free.




Other than aesthetic reasons, does it really make a difference in security sense between these two types of encryption methods?

4) For the case above, what happens when the cert expires in Oct? Will CloudFlare renew it automatically?

5) What is the purpose of using letsencrypt SSL instead of a paid Cloudflare SSL? It's only the price difference or there is some other advantages?

6) I remember it's mentioned to use only the DNS of Cloudflare insterad of the proxied one (orange cloud). Why?

Sorry for all these questions. Obviously I'm not really a very experienced system admin. But I'm eager to learn.

Thanks a lot.

 

Thanks eva2000. I feel touched to have got your answers. My mind is so clear now... kind of.

SSL is so confusing.. So am I all good now regarding the SSL functionality part and can move on to next step?

I notice there's a cloudflare.conf I think it's related to reveal the true IPs of visitors （I'm not using it now）? If I don't configure/use it, I only get the IPs from cloudflare in the server logs, right? ///NO. I just checked the access.log, it actually shows my IP, not the IP of cloudflare...

And what's Authenticated Origin Pulls now? Do I need to use it?