Need help with CNAME setup using Letsencrypt and Cloudflare

by xh3b4sd

Hey there, I got a new problem I am not sure how to solve right now. Hope somebody would be up for checking this out with me together.

I have app.aws.example.com running just fine. That DNS record is setup via cert-manager which uses Letsencrypt. All good in the hood with this one. Now DNS for example.com is managed in Cloudflare and I thought I can just create a CNAME for fancy.example.com pointing to app.aws.example.com. And actually, I can. Though the connection does not work because of some SSL magic I don't understand right now. Anybody curious can reach out to me on Twitter. Maybe we can hang a bit and figure this out together. I would buy you an apple juice for sure! Below one example error ala SSL Handshake Failed.

curl: (35) LibreSSL SSL_connect: SSL_ERROR_SYSCALL in connection to fancy.example.com:443

xh3b4sd

posted to

Developers

on January 4, 2021

Say something nice to xh3b4sd…

Post Comment

2

tl;dr you need a cert issued specifically for fancy.example.com

The problem you're running into is how SSL/TLS actually work. Creating a CNAME simply tells whatever is making the request where to find the server that will respond to the request - in this case, fancy.example.com will resolve to the same host/IP as app.aws.example.com, but whatever is terminating SSL on app.aws.example.com is going to see the host header set to fancy.example.com and match it with a corresponding certificate (if it has one).

Cloundflare can make this a little funky depending on if you have their caching/proxy turned on for that DNS record. If you do, then it should work I think since Cloudflare will handle SSL termination for fancy.example.com and then make a proxied request to app.aws.example.com

seanmcgary

·
5 years ago
·
Reply
1. 2
  
  Hey Sean, great you reach out. I got a couple of nudges in this direction and have to try something out. I think you are right. The server terminating SSL is not aware of the host header entry and thus disallows access. I got cert-manager under the hood and just have to reorganize my funny setup a bit. I will let you know how it goes. <3
  
  xh3b4sd
  
  ·
  5 years ago
  ·
  Reply
2. 1
  
  I finally got to work on this a bit more. In the end I did what you suggested. Just took me a bit to figure out how to put the pieces together. I solved the problem by issuing a dedicated certificate for fancy.example.com and wired that up in the ingress gateways so that traffic is routed to the virtual service's backends. Thanks a lot for your help!
  
  xh3b4sd
  
  ·
  5 years ago
  ·
  Reply