Free SSL cert questions

[tonyokolie51]

I installed free ssl certificate on my website tomanzi.com.ng, wholesale.tomanzi.com.ng, warehouse.tomanzi.com.ng from cloudflare some days ago, and it was successful but the SSL/TLS Status is still having problems on my cpanel.

Please check the attachments : for better understanding:

Please help solve these issues

![20230608_171513|281x500]
(upload://43fYZT2jmCtcduU2IbPswhDosdX.jpeg)

[fritex]

@tonyokolie51

I installed free ssl certificate on my website

Given from cPanel AutoSSL, or Cloudflare Origin CA certificate, or some other?

@tonyokolie51

it was successful but the SSL/TLS Status is still having problems on my cpanel

If you’ve used and generated a Cloudflare Origin CA certificate, it would always show some alert in cPanel interface since it’s self-signed one which works only for HTTP(S) traffic while using Cloudflare proxy . Meaning, your e-mail related services wouldn’t function and work at all. cPanel wouldn’t be able to renew it neither. To get rid of cPanel AutoSSL notifications, uncheck it from renewing process.

Otherwise, stick to the cPanel AutoSSL, use Full SSL (not strict), and make sure to allow both HTTP and HTTPS traffic so cPanel AutoSSL can renew it. Nevertheless, allowing HTTP traffic IMHO isn’t the best practice nowadays.

I’d rather keep it secured & safe, including the Full SSL (Strict).

There are posts around some workaround(s) here about this topic too. Sharing below, hope it helps. In the meantime, feel free to write back.

Email with Origin Certificate

I have discovered that the AutoSSL certificates in cPanel were not updating automatically since I started using Cloudflare. Interestingly, I was not receiving any errors and on the dashboard it was still saying I had “Full” end to end encryption. Not sure how that was happening with expired certificates! I am now adding Origin Certificates to get around the AutoSSL issue, but some of my domains have email servers. How will Origin certificates affect that as they’re “DNS only”?

From the shared screenshot above, you also have deep-subdomain issue like the www.wholesale.tomanzi.com.ng which can be fixed by using the Advanced Certificate Manager:

Subdomain too deep

This tutorial covers a possible reason for the SSL_ERROR_NO_CYPHER_OVERLAP and ERR_SSL_VERSION_OR_CIPHER_MISMATCH errors (Firefox and Chrome respectively) when seen on a subdomain. The Cloudflare universal certificates cover example.com and *.example.com. This means that it covers any subdomain one level below the domain you signed up with. It will cover www.example.com and subdomain.example.com, as these are one level below the root domain, example.com. The certificate will not cover www.sub…

Advanced certificates · Cloudflare SSL/TLS docs

[tonyokolie51]

2 CHALLENGING SSL ISSUES:

1. My domain and subdomain is showing not secured on Android but is secured on desktop. tomanzi.com.ng, wholesale.tomanzi.com.ng, warehouse.tomanzi.com.ng Please check attachments for better understanding

2. Domain SSL/TLS STATUS is showing this and I don’t understand

The certificate has the For following errors: Certificate #2 (ST=California,L=San

Francisco,OU=Cloudflare Origin

SSL Certificate

Gene Authority,O=Cloudflare, Inc.,C=US) has 2 validation Current User errors:

tonSELF_SIGNED_CERT_IN_CHAIN, CERT_HAS_EXPIRED.

Please help me for solutions

)

[tonyokolie51]

[tonyokolie51]

[epic.network]

The Untrusted notification is to be expected when you make a direct connection to a hostname that uses a Cloudflare Origin CA certificate. Cloudflare Origin CA certificates are not trusted by web browsers and are used to secure the connection between the origin server and the Cloudflare proxy. When you use a Cloudflare Origin CA certificate with a record that is Proxied, you will not see the Untrusted notification because Cloudflare trusts that certificate.

Set the to and it should fix that.

[tonyokolie51]

Mr epic.network, I have spent almost 5 days on cloudflare community, my problem not solved, I have message before and you replied:
Please do not open duplicate topics. It dilutes resources and makes it take longer for you and others to receive assistance.

Duplicate of Free SSL cert questions

Please how can I get my problem solved. I’m having 4 issues with my domain since I changed my namesavers to cloudflare, I have scroll almost all the topics but still can’t fix my problem please can you help solve my issues,

[anon9246926]

@tonyokolie51 have you followed the advice given in the most recent reply by @epic.network on your thread

Free SSL cert questions

The Untrusted notification is to be expected when you make a direct connection to a hostname that uses a Cloudflare Origin CA certificate. Cloudflare Origin CA certificates are not trusted by web browsers and are used to secure the connection between the origin server and the Cloudflare proxy. When you use a Cloudflare Origin CA certificate with a record that is Proxied, you will not see the Untrusted notification because Cloudflare trusts that certificate. Set the to a…

[tonyokolie51]

Set the to and it should fix that. Please can you use examples where to do this because I don’t understand

[tonyokolie51]

And my domain on mobile showing not secured​:unlock:
But on desktop is secured​:lock:
Please how can I fix this

[anon9246926]

Rather than replying on another thread @tonyokolie51, please continue the discussion here.

From what I can see the domain is proxied

$ dig tomanzi.com.ng
tomanzi.com.ng.		300	IN	A	172.67.203.95
tomanzi.com.ng.		300	IN	A	104.21.52.200

The site also loads with SSL for me on both mobile and desktop.

Have you tried accessing the site on a different device to rule out the possibility of an issue with the device you are using?

[tonyokolie51]

Thank you so much for this, you are good
It loads in another device.
So how will I fix this on my device?

[tonyokolie51]

Because I have clear all my cache like more than 30 times But still the same issues since 5 days now

[sandro]

@tonyokolie51, you should also make sure your encryption mode is Full Strict, otherwise none of the certificates will be validated and the site will still be insecure. As @fritex already wrote.

[tonyokolie51]

Yes I did that 2 days ago

[anon9246926]

@tonyokolie51

So how will I fix this on my device?

This is outside of my scope of knowledge unfortunately.

[tonyokolie51]

This is my DNS records
Please help me check if there is mistake from here.

[tonyokolie51]

[anon9246926]

They all appear correct.