Can't use Proxy or Strict SSL all of a sudden

[neiljay]

Hello there,

@judi

but can’t use proxy or strict SSL.

May I suggest you to check out these #tutorial for setting up the SSL?

Step 1: Adding your domain to Cloudflare

This tutorial covers creating a Cloudflare account, adding a domain, changing nameservers and checking imported DNS records. Sign up Go to dash.cloudflare.com/sign-up, enter your Email and create a password, read the terms and notices and click ‘Create Account’ [Sign-Up Page] Add site Enter your domain. This has to be your actual domain (e.g. mydomain.com or mydomain.co.uk) and must not include any domain specific hostnames (e.g. www.mydomain.com or similar). Furthermore the domain has to …

Step 2: Setting up SSL with Cloudflare

This tutorial covers getting SSL working with Cloudflare in various different scenarios. This assumes you already have your website set up on Cloudflare with all your DNS records set to , if not - please visit Step 1. Do you want the website to use HTTPS?

Yes

Do you already have a valid SSL certificate installed on your server (i.e. does it already load over HTTPS with a )? Yes If your website already works over HTTPS, you can just set your SSL mode in Cloudflare to Full (strict)…

Step 3: Enabling the 'Orange Cloud'

This tutorial covers what records can be set to and what should be left at . What does do? The orange cloud means that traffic to that hostname is running through Cloudflare This includes Masking your IP Caching an HTTPS certificate on the edge servers (a separate certificate on your server is still necessary) What records can you enable for? A, AAAA and CNAME are the only records that can have enabled, but not only those related to web…

Step 4: Checking your site after adding it to Cloudflare

This tutorial covers checking your site after configuring it with Cloudflare. If you have not yet configured it, you may want to go back to Step 1. At this point, your site should be accessible over HTTPS, you should visit https://yoursite.tld and check it out. If you do not see the site as secure or you don’t see the Cloudflare certificate, try clearing your cache / using a different device on another network. Your site may be working perfectly now over HTTPS, if it is then your initial setu…

SSL/TLS app Settings

SSL/TLS Configuration Video: This tutorial covers basic settings in the SSL/TLS app of the Cloudflare Dashboard, including SSL Mode [Off/Flexible/Full/Full (Strict)], Cloudflare Origin Certificates, ‘Always Use HTTPS’ and ‘Automatic HTTPS Rewrites’. The settings covered here can all be found by visiting Cloudflare.com, logging in, selecting the domain and choosing the SSL/TLS app. [SSL:TLS Button] SSL Modes [|717px;x331px;] Off The connection between your visitor and Cloudflare and Clou…

[judi]

Hello…

Thank you for the response – but all that is in place correctly. What is happening is errant IPs are showing on dnschecker.org that are NOT on the DNS record on Cloudflare.

The site has had the same – unchanged – settings on Cloudflare for years. Then, out of the clear this weekend, these unrelated IPS seem to be in the mix somehow.

No one can tell me why or how this is happening – with the correct settings on Cloudflare. Because of this, the site goes offline when I turn on proxy and Full (Strict) SSL.

[neiljay]

Are you using any kind of third part integration like ezoic? Would you share the domain here?

@judi

site goes offline when I turn on proxy and Full (Strict) SSL.

Is that behavior only on Full Strict? Have you installed origin certificate?

[judi]

Thank you for the response! I didn’t get a notice of your reply… Nothing has changed on the site for a very long time – this just appeared this weekend on 10/3.

No third-party integration nor an origin certificate.

The site is ParacordPaul.com

Proxy has to be OFF and SSL to Flexible for the site to not display a security screen. This is across all browsers and my iPhone too.

Appreciate your patience with me!

[neiljay]

@judi

I didn’t get a notice of your reply…

You can change that too at the notification bar.

Here’s the overview:
At the moment, your site is running on https.
Your site has an SSL & you’ve turned off the proxy.

The issue: You’ve a missing CAA records in your DNS.

@judi

This is across all browsers and my iPhone too.

The screenshot you’ve attached is when proxied?

@judi

The host says not them – the DNS record in the Cloudflare account displays correctly

It isn’t. You need to check the records again.

@judi

but can’t use proxy or strict SSL.

In order to use Full Strict, you need to have a certificate on the origin server.

[epic.network]

@judi

errant IPs

How are you determining that the IPs are “errant”? Whose IPs are they?

[judi]

Thanks again…

I did activate alerts – and nothing. So, there is a certificate on the origin server. The host determined that the Universal SSL on Cloudflare just expired – it didn’t renew as it has for years. They have gone above and beyond in helping me determine why out of the clear blue sky this happened.

I found another thread about this here.

The thing is, we tried that process, and it won’t renew. And, since it is a free account, I cannot contact CF to ask why it didn’t renew. Hence, I am back here just trying to get the site to work as it always has with CF.

Thank you again!

[judi]

@epic.network

No idea whose IPs they are…

The host provided screenshots from dnschecker.org when CF Proxy was engaged and SSL Strict – that shouldn’t be there when the site was offline.

Now that proxy is off and flexible SSL is in place – the site is live. Turn them back on – no go. Turns out the free Universal SSL just expired and didn’t renew as it has for years.

Not sure what I can do now…

Thank you for your interest!

[judi]

@neiljay @epic.network

[neiljay]

@judi

@judi

Not sure what I can do now…

Thanks for the update. This is mostly due to deprecation of Digicert certificate. You can read related thread here & the expert view:

Universal SSL on Free Account expired

Yeah I may have skipped some background information, which is not obvious for you. Sorry for that. But since this was configured a year ago (the SSL part) this was not changed. The Website itself is on Cloudflare for multiple years now and there weren’t any changes for more than a year, so the only thing that really happened is that the certificate expired and the site is prevented from working with the bogus cipher error… it took me some time to figure out the very absconded reason that the e…

Additionally, check this out:

DigiCert update · Cloudflare SSL/TLS docs

Universal certificates - DigiCert migration guide · Cloudflare SSL/TLS docs

[epic.network]

@judi

No idea whose IPs they are…

That’s why I included a link to an online whois lookup, to make it easier to determine whose IPs they are. We can always revisit the “errant IPs” later if they appear to be relevant.

@judi

proxy is off and flexible SSL is in place

Those are mutually exclusive conditions. You have to have the proxy enabled for Flexible SSL to mean anything. Flexible redirects HTTPS requests received by the proxy to HTTP requests at the origin.

Based on the other details that you have shared, I endorse @neiljay’s diagnosis. You may be able to remedy this on your own using the Cloudflare API.

The example in the following post with lets_encrypt for digicert should get you going.

Change Let's Encrypt SSL to

I was able to set it with: curl --location --request GET 'https://api.cloudflare.com/client/v4/zones/<Zone ID>/ssl/universal/settings' \ --header 'Authorization: Bearer <API Token with SSL:edit>' \ --header 'Content-Type: application/json' \ --data-raw '{"certificate_authority": "digicert"}' Is this your Global API key?

[judi]

@epic.network @neiljay

Thanks, guys, for sticking with me on this – it’s above my paygrade. I’ve emailed [email protected] since they seem to be aware of this cert migration issue (Digicert to Let’s Encrypt) and hope they can help to resolve it.

My host, WPMU, also went above and beyond to help determine what was at play too. This is what I love about the online community – those willing to spend time to help!

Much appreciated!

[judi]

@ccahoon

I’m tagging you here on this thread has the same issue as the thread you helped with here, but it was closed 2 days ago, so I couldn’t contact you there.

I did email [email protected] as you instructed there but got the autoresponders – immediately noting my case was “resolved,” which it isn’t.

I know I’m on a free account, but this is on your side to resolve (according to the referenced thread) due to migrating from Digicert to Let’s Encrypt on the backend. What can I do about that? Can you help? TYVM!

[epic.network]

I already shared this topic in a related escalation thread.

If the autoresponder that closed your support request generated a ticket number, would you share it here?

[ccahoon]

Hello @judi

Had you attempted the api call as mentioned by @domjh on the referenced thread you found now closed - Universal SSL on Free Account expired - #23 by ccahoon

• which in turn the api call was referenced from another thread CA certificates - #3 by user4918 (Note: On the example call you would change the CA provider from Digicert to Let’s Encrypt

i.e.

*curl -X PATCH “https://api.cloudflare.com/client/v4/zones/[zone_id]/ssl/universal/settings” *
*-H “X-Auth-Email: [email]” *
*-H “X-Auth-Key: Global API Key” *
*-H “Content-Type: application/json” *
–data ‘{“certificate_authority”:“lets_encrypt”}’

ref: https://api.cloudflare.com

After the above call, you may need to then toggle off the Universal SSL switch & re-enable for the CA switch to take effect.

If still no success, please provide the ticket ref you received the auto response & closure on.

[judi]

@ccahoon

Thank you so much for the reply! I have no idea what to do with the API info you provided. Everything after “i.e.” is Greek to me – and I’m Greek!

I am a simple user who has had this site on Cloudflare for years without issue. Then apparently, your side made a change and took my site offline without notice, and I had to disable proxy to get it to display.

That thread also mentioned that there should be some sort of notice to those that this would impact. I never received anything about this. Is there a simple step-by-step that a novice can use to do this?

Here is the ticket: [Cloudflare Support] 2583130.

I know other folks just like me who have sites on Cloudflare – are they going to run into the same thing?

Thanks for any help you can offer on your side.

[ccahoon]

Hi Judi

Thanks for the ticket ref.

New CA has been applied & further instructions are in your ticket.

[judi]

@ccahoon

Just saw that – THANK YOU!

[ccahoon]

Update: If users come across this thread with the same issue - Our Engineers have just released the bug fix for this scenario overnight & therefore it should no longer be an issue.

ref: CUSTESC-22473