NET::ERR_CERT_AUTHORITY_INVALID and Origin Server certificates

Website, Application, Performance
1

2022-12-26_10-21-22
2022-12-26_10-21-22790×220 47.1 KB

Hello @sandro
You set this Topic as solved. I know there are different issues there, but I think that MAYBE @geopehlivanov is facing a similar problem that I am.

I believe I installed my CA Origing Certificate as described in the procedure, change it to FullStrict, etc. But I am getting the NET::ERR_CERT_AUTHORITY_INVALID warning when I visit my page.

When I use the SSL Checker it says that the installed certificate is OK, but the root Cloudflare ORIGIN SSL CERTIFICATE AUTHORITY is not valid since November 12, 2019.

Do you (or someone else) know how can I solve it?

2

Topic - (://community.Cloudflare.com/t/net-err-cert-authority-invalid-in-google-chrome-browser/445662)
Procedure - (://developers.Cloudflare.com/ssl/origin-configuration/origin-ca)
SSL Checker - (://www.sslshopper.com/ssl-checker.html)

3

Origin certificates should only be used on a :orange: Proxied hostname.

That bottom cert also looks expired. If that’s the root CA certificate, current ones are available here:

https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/#4-required-for-some-add-cloudflare-origin-ca-root-certificates

1 Like
4

Thanks @sdayman!
My hosting is expecting a .KEY to install the new root certificate.
Do you know how can I get it?

2022-12-26_13-15-43
2022-12-26_13-15-43641×635 134 KB

5

Yes, how exactly to install this root certificate without private key?
I still cant resolve my issue. It’s really frustrating. In Chrome still domain unmask server ip and get the same error.

Screenshot (120)
Screenshot (120)1920×1080 56.9 KB

Screenshot (121)
Screenshot (121)1920×1080 56 KB

Screenshot (122)
Screenshot (122)1920×1080 155 KB

Screenshot (123)
Screenshot (123)1920×1080 138 KB

Screenshot (124)
Screenshot (124)1920×1080 150 KB

Screenshot (125)
Screenshot (125)1920×1080 139 KB

6

Origin Server certificates generated by Cloudflare should only be installed on servers that you place behind a proxied DNS record. The certificate on your server should only be seen by Cloudflare and will not be valid in a browser or via SSL Labs or any other validator.

So the solution here is either:

a) Turn on the Proxy (aka Orange Cloud) for the DNS record you’re seeing this error on
b) If you cannot turn on the proxy, you must install a valid certificate on your origin server from a CA such as Lets Encrypt

1 Like
7

Proxy (orange cloud) is turn on and it works in all other browsers I tested, instead of Chrome.
@paulus Do you have the same problem with Chrome, or with all browsers?