Installing Cloudflare SSL certificate on my server

ivangorshkov · November 21, 2023, 10:39am

I generated the new Cloudflare SSL certificate for free. It looks like this:

I can see Certificate and Private Key. How can I get the CA Budle info? Can it be used without it and how? My server requires 4 files:

domain.ca ← ca_bundle.crt
domain.crt ← certificate.crt
domain.crtca ← certificate.crt + ca_bundle.crt
domain.key ← private.key

Is it possible to get all files of sertificate I need (as it is provided by ZeroSSL or LetsEcrypt)? Very strange here on Cloudflare!

ivangorshkov · November 22, 2023, 10:45am

I created Origin Certificate and Private key in SSL → Origin Server. My server uses Apache + Nginx, and I need CA Bundle in addition to the Origin Certificate and Private key I got. Where can I get Cloudflare Root Certificate to create CA bundle?

ivangorshkov · November 22, 2023, 1:21pm

I downloaded the root certificate and the origin certificate. I believe that domain.crtca consists of root certificate and intermidiate certificate(s). I created domain.crtca like this: Cloudflare origin certificate above and Cloudflare root certificate below. Still Cloudflare states that this SSL cerificate is not valid (526). Where can I check the cerificate itself? Am I dowing wrong?

Спойлер

epic.network · November 22, 2023, 9:29pm

It looks like you figured this out. Are you still having trouble with your Cloudflare Origin CA certificate?

CFBrandon · November 22, 2023, 9:52pm

Hello there!

Cloudflare does not issue Let’s Encrypt (or any other publicly trusted CA certificate) for use at your origin server.

If you want to use a certificate from Cloudflare on your origin, this would be done with an Origin Certificate. https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls/origin

The Origin Cert is only trusted by Cloudflare. If you are only accessing the origin through Cloudflare, or directly by IP address on local network, this may solve your problem. However, if you’re using an internal DNS resolver, an Origin Cert will throw an insecure certificate warning.

In this case, you may want to consider using something like Certbot to get a Let’s Encrypt certificate. It will still work with Cloudflare, and it will provide secure connections for LAN access.

Please let me know if you have any questions or require further assistance!

ivangorshkov · November 23, 2023, 8:13pm

root + intermediate + ssl = ca bundle for my Nginx server.

I created 15 years origin ssl certificate (and private key) in the Origin Server section of my free CF account.

Also I got the root (Origin RSA PEM) CF certificate here.

I read that I need the CF intermediate certificate to create the CA Bundle for my server to connect with the Cloudflare server. Somebody told me that there is an intermediate CF certificate here - I found the 48K lines int-bundle.crt file there. I have doubts that this is the proper intermediate CF certificate.
Please, advise. Is there a chance that you will make this process easier in the future, guys?!

ivangorshkov · November 23, 2023, 8:24pm

I still in the process. Please, reply here.

sjr · November 23, 2023, 9:06pm

You just need the certificate and private key. I’m not sure why you need or want the whole chain.

One of many guides here…

Laudian · November 23, 2023, 9:07pm

There is no CF intermediate certificate.

You don’t need a CA bundle.
ssl_certificate should be the certificate (public).
ssl_certificate_key is the private key.

There’s no reason you should require more than these 2 files…
If you’re using some panel that absolutely requires this, just use the root certificate as the “bundle”.

Also, the private key is called private for a reason - you really shouldn’t share the key, or even parts of it, on the internet. I recommend you revoke that certificate and create a new one.

ivangorshkov · November 23, 2023, 9:07pm

Because Nginx server works like this.

Nobody with Nginx server here? Please, stop this “you do not need the intermediate sertificate”.

Actually I used root+ssl as bundle, and seams CF accepts this. But I do not know if it is really correct since I can not check this certificate being behind the Cloudflare strict DNS.

sjr · November 23, 2023, 9:28pm

Yes, we’ve used nginx on Cloudflare, although we use Apache for production.

You need to bear in mind that the Cloudflare origin certificate is only for use between Cloudflare and your origin. It won’t be trusted by a browser connecting directly to your origin.

Why not just get a LetsEncrypt certificate if you don’t like the Cloudflare origin certificate?

ivangorshkov · November 23, 2023, 9:33pm

You do not need to write it again and again that Cloudflare’s certificate works only for Cloudflare ↔ my server connection.
Just tested - the Cloudflare ssl + key works fine. No need for root or intemediate. Seams that I was misled by the lack of information.
Regarding Let’sEncrypt - it is only for 3 months and I receive it manually - tired from that. (Yes, I know about some scripts).

sjr · November 23, 2023, 9:36pm

As we said.

ivangorshkov · November 23, 2023, 9:38pm

How do I check the validity period ot this Cloudflare Origin Server certificate in browser of via ssh client? I set 15 years when I was getting it on Cloudflare. Just want to check if the happiness is finally here.

epic.network · November 23, 2023, 9:42pm

# for what dates is it valid?
openssl x509 -noout -in cert.pem -dates

https://www.madboa.com/geek/openssl/

ivangorshkov · November 23, 2023, 9:52pm

Thank you, sir!
![Joxi (272 kb) закачан 16 ноября 2023 г. Joxi – Brave|690x110]

system · December 7, 2023, 10:46am

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.