Cloudflare, Inc.

Ryan Lackey

Nicholas Thomas Sullivan

Zi Lin

Lee Hahn Holloway

Dane Orion Knecht

John Graham-Cumming

Piotr Sikora

Patrick Donahue

Rajeev Devendra Sharma

C Erik Berls

Tom Gunnar Sparks

A server receives a request from a client to establish a secure session. The server analyzes the request to determine a set of one or more properties of the request. The server selects, based at least in part on the determined set of properties, one of multiple certificates for a hostname of the server, where each of the certificates is signed using a different signature and hash algorithm pair. The server returns the selected certificate to the client.

Dynamically serving digital certificates based on secure session properties

A method and apparatus for enabling an HSTS policy for a subdomain of a domain is described. A request for content at a subdomain of a domain is received at a proxy server from a client device over a secure transport. The proxy server determines whether the subdomain is associated with a rule indicating that Hypertext Transport Protocol Strict Transport Security (HSTS) is to be enabled for the subdomain of the domain. Responsive to determining that the subdomain is associated with the rule, the proxy server transmits, to the client device, a first response that includes an HSTS header and which instructs the client device to communicate only over the secure transport for requests for content at the subdomain, wherein the first response includes the HSTS header regardless of whether HSTS has been enabled for the subdomain at an origin server.

Methods and apparatuses for enabling HSTS policy for a subdomain of a domain

Managing distribution of sensitive data is disclosed. In one example, a request is sent to a control platform to add a virtual domain. A domain key associated with the virtual domain is received. A request that the credential be transmitted to the virtual domain is sent, along with the application credential which has been encrypted using the domain key. In another example, a request that one or more application credentials be pushed to a virtual domain is received from a configuration console. The virtual domain is notified that at least one action request associated with the virtual domain is available. A signed request is received from the virtual domain for the action request. The application credentials are transmitted to the virtual domain. In a third example, an application credential of a virtual domain is requested. A signed message including an encrypted application credential is received from the control platform.

Managing distribution of sensitive information

Growing community of inventors

Seattle, WA, United States of America

Ryan Lackey