Hello,
Unfortunately, we have always seen issues with CloudFlare, and they are usually random. What I mean is that you can go for 2-3 months using CloudFlare and not have an issue then for a full year of 2017 for example, they blocked all of Apple Podcasts IP addresses. Their competitor Encapsula, has the same problems. They are primary focused on security and they can get get aggressive on what they block, and they block based on user agents that are not web browsers. Unfortunately for podcasting, podcast apps including Apple podcasts do not use browser user agents which is where most of the problems come in.
As for the SSL cert, Apple is picky on which SSL certs it accepts. I see looking at the SSL cert it is now signed by CloudFlare themselves, it may be that their root certificate is not in the list of 9 top root certificates that Apple accepts. CloudFlare’s CErts are signed by DigiCert. DigiCert is not signed by any root certificates. A quick look at Apples documentation you can see DigiCert is not on their list: https://itunespartner.apple.com/en/podcasts/news/19855810
DigiCert is not a root certificate, its root certificate is Symantec, which is on Apple’s list. The problem is CloudFlare is not including the root Symantec certificate. You can point them to this link for details how this is achieved: https://knowledge.digicert.com/generalinformation/INFO4033.html
Continuing to use CloudFlare even if you get them to fix the SSL issue does not solve all of the other issues we have seen with CloudFlare and podcasting. Continue to use CloudFlare and you will continue to have random issues. You may think that you did not have issues in the past, but I guarantee you have had problems and may just not have known about them. We have consulted with hundreds of customers over the years who had CloudFlare. Just be aware that CloudFlare makes no claim to be compatible with podcasting or that they take podcasting into consideration when they make security changes with their platform.
We recommend using a service such as Blubrry’s free PodcastMirror.com service or if you do not want to trust Blubrry, you could use FeedBurner to achieve the same goal. A mirror/copy of your podcast feed will be hosted on a service that is known not to have issues with podcasting apps and more specifically Podcast Mirror is designed to work for podcasting.
As for your media on Amazon s3, if you are using their signed certificates, they are also not compatible with Apple podcasts. You can solve this by using a combination of features at AWS including Route53 + CloudFront + S3 and bringing your own signed certificate.
It is important to note that the SSL certificate problem is specifically with Apple podcasts directory. The technical problem is due to the fact that they use Java for their feed pulling system, they are dependent on what certificates Java itself has packaged with in the version of Java they are using. Once someone is subscribed, you should not have an issue as all traffic is then between that listeners’ device (iPhone/ipad) and your web services. It is possible you could ignore issues with the audio files, but you do need to fix the feed issue otherwise Apple will not be able to maintain your listing on Apple’s podcast directory. I hope this makes sense.
Thanks,
Angelo