Moved domain. Some A records not working when Proxied

[kev1]

Hi,

I’ve just moved a domain over to Cloudflare which has a number of A records which point to virtual hosts on my home development server.

Some are working fine as they are, but some will only work if I change the Proxy status to DNS only. As these accounts are on my home server I really would like to hide the static IP address at my home for obvious reasons.

The website of the domain I have moved is hosted on another server which has cpanel/whm which is where I managed the dns zone. I have tried removing the A records from the WHM panel, but this appears to have not made any difference.

Odd that some work being proxied and some don’t. I’m so confused!

[epic.network]

Welcome to the Cloudflare Community

Can you more explicitly define what you mean by not working?

I can readily think of two common scenarios that “don’t work” when proxied.

Subdomain too deep

This tutorial covers a possible reason for the SSL_ERROR_NO_CYPHER_OVERLAP and ERR_SSL_VERSION_OR_CIPHER_MISMATCH errors (Firefox and Chrome respectively) when seen on a subdomain. The Cloudflare universal certificates cover example.com and *.example.com. This means that it covers any subdomain one level below the domain you signed up with. It will cover www.example.com and subdomain.example.com, as these are one level below the root domain, example.com. The certificate will not cover www.sub…

Network ports · Cloudflare Fundamentals docs

[kev1]

Hi,

Thank you for your reply which set me off in a direction where I have resolved the issue.

On my home development I had some my sites secured with SSL via lets enrypt , and it was these which has a subdomain specific SSL cert being used which caused the issue. The flexible SSL encryption was also being used from Cloudflare.

After removing the SSL setup on my development server everything is working fine and all proxies are working.

[cscharff]

Flexible is not the correct choose when the origin accepts SSL, instead it should be full or full full strict.

[kev1]

Hi cscharff,

Not sure I should do that as the main website for the domain name which I moved is hosted on another server.

If I setup the SSL with the origin of my development server, would the main site no longer work correctly under SSL ?

I’m new to this stuff, so apologies in advance for stupid questions.

[epic.network]

@kev1

would the main site no longer work correctly under SSL ?

Why would the main site not work correctly just because you used TLS on another site?

Use TLS everywhere. Don’t use Flexible.

Why you should choose Full Strict, and only Full Strict

Unencrypted & unverified connections Imagine you open Paypal and suddenly get that warning [image] Would you continue? Probably not. For decades leaders in IT security have advocated that people upgrade their sites from unencrypted HTTP to secure HTTPS. And for a reason, everything you send via an HTTP connection is sent in plain text and can be intercepted at any point between you and the server. Equally, you’d probably not proceed if you got such a warning, right? [image] That’s when th…