Custom domain behind Cloudflare full strict SSL mode

Hey Russ, Shaq from the Support team here in Chicago 👋! Great questions, I’ve added feedback below.

1 - Does HTTPS (quick setup) support full strict SSL via Cloudflare? 

Per our doc here strict SSL is not supported and will result in an error: https://www.intercom.com/help/en/articles/7301427-troubleshooting-custom-domain-set-up-and-https-ssl

2 - Are we able to have HTTPS (quick setup) enabled for our account retroactively?

Would you be able to elaborate on this question more? There doesn’t seem like an option to set up SSL in the past but I could be misunderstanding what you mean. I want to make sure I give you the best response here. Looking forward to your response😄!

Thanks! 

Thanks for the response ​@Shaq Payne 

So we’re in a position where the parent domain/zone we wish to host a custom subdomain within is configured to use the Cloudflare Full (strict) TLS mode, as is best-practice. Not supporting this means we’re left with either having to degrade our security posture, or run a proxy just for Intercom (which I’m somewhat reluctant to have my team do)

Does Intercom not support provisioning Let’s Encrypt certs, or similar, for customers wishing to achieve this? There must be plenty of us in the same situation. It appears as though your “HTTPS (quick setup)” implementation provides a certificate, in which case are we able to just configure a CNAME with the Cloudflare proxy disabled?

Referring to the following statement in this doc, it appears this should be possible:
“Since HTTPS (quick setup) option already provides SSL”
 

Cheers

Russ

​@Shaq Payne do you have any feedback from the Product team on this issue, or is there a technical team you’re able to put me in touch with to discuss our options? Currently it seems our only routes forward are:

1 - Degrade our security posture by removing end to end TLS termination
2 - Maintain a proxy just for our Intercom help centre

Our setup is very common, I’ll be quite surprised if we’re the only people having this issue.

Hey Russ 😀

Our Product team has already implemented this Quick Setup option to address this. Can you let me know why it doesn’t work for your team? 

Have you tried this:

“It appears as though your “HTTPS (quick setup)” implementation provides a certificate, in which case are we able to just configure a CNAME with the Cloudflare proxy disabled?”

If so, what issues have you faced? Let me know! 

Other than this, I can confirm that it isn't currently possible to use a custom domain for your Intercom help centre while also using Full (Strict) mode. There aren't any workarounds either. But if you’re running into issues with the the Quick Setup option, we can definitely take a look there.