Cloudflare's certificate sharing

[Hunter-Github]

The choice of certificate is rather unfortunate. The SANs are shared with, among others:

• icanhazmeow.com
• warezfiles.ru

It's weird to see a site dedicated to keeping secrets co-located with a "warez" host. The server gets an A grade from Qualys, and no one complained about CloudFlare so far, but the co-tenancy is kinda risky (see https://security.stackexchange.com/a/37038/13820).

[sethvargo]

Hi @Hunter-Github

Thank you for opening an issue. I definitely understand your concerns about the shared certificate. We use CloudFlare as our CDN. We also value the importance of secured connections, so we want to run Vault's website over SSL. However, given that no secure information is exchanged via the website, I think the attack framework here is rather small. Obviously you would never run a Vault server on a shared certificate, but for the purposes of a product website, I think it is fine. What do you think?

[Hunter-Github]

I can see your perspective now. Thanks a bunch for answering.