春江暮客

春江暮客的个人学习分享网站

The Risky Experience of Using Baidu Cloud Acceleration and Cloudflare Together

2019-09-02 Miscellaneous
The Risky Experience of Using Baidu Cloud Acceleration and Cloudflare Together

Considering that Cloudflare’s free sites are really slow in China, and that Baidu Cloud Acceleration in China uses Cloudflare’s technology, I thought using Baidu Cloud Acceleration CDN would speed up the website’s access within China.
Here I record the entire process of using Cloudflare as CDN which caused the site to become inaccessible. 0-0

1. The website is already registered with Alibaba Cloud ICP, so Baidu Cloud could be used directly, although there’s a cumbersome real-name verification process with ID card verification, which I passed smoothly.

2. Then added the site domain to Baidu Cloud Acceleration via CNAME, and Baidu gave the CNAME record.

3. Added DNS records in Cloudflare’s domain management under the DNS section.

4. An error occurred, and the website crashed.

Reason for this situation

More precisely, the outage was caused by stacking two CDN or DNS proxy layers for the same site at the same time, which made the DNS and origin-routing path inconsistent. Cloudflare was not permanently unusable; the actual problem was the conflicting proxy and DNS configuration.

Here are the solutions:

1. Use Baidu Cloud Acceleration, but it doesn’t offer free SSL. The SSL certificate costs at least 2490 RMB… so definitely not using it.

baidu_zeigui

2. Use other CDNs.

3. Cancel CDN and access the origin server directly.

Here’s the process of canceling Cloudflare CDN:

1. Change NS records back to Alibaba Cloud.

2. Cancel DNSSEC by deleting DNSSEC records on Alibaba Cloud. See reference: Enable DNSSEC on Alibaba Cloud Domain to Prevent DNS Hijacking

3. Re-add DNS resolution records — just re-resolve the www domain.

After the rollback, it is worth checking that DNS and HTTP responses now point where you expect:

dig bobobk.com
dig www.bobobk.com
curl -I https://www.bobobk.com

If the DNS answers and response headers match your intended CDN or origin setup, the switchback is usually complete.

After this, the website was finally accessible again.

友情链接

其它