SSL error for website https://jam-dev-env.io hosted on Cloudfare

Answer these questions to help the Community help you with Security questions.

What is the domain name?
jam-web-env.io

Have you searched for an answer?
yes

Please share your search results url:

When you tested your domain, what were the results?
We can access the website

Describe the issue you are having:

When we browse the website https://jam-dev-env.io, it gives us certificate error.
We have generated certificate from Cloudflare (.Pem and .Key files) and imported to the Linux server where this website is hosted and binded to it. But it says not secure when we acces…
We can access the website on http protocol. We see the certificate is issued by Cloudflare. Please assist ASAP to help us resolved the issue. We have enabled strict settings as per below article but still issue persists
.
Flexible - SSL/TLS encryption modes · Cloudflare SSL/TLS docs

What error message or number are you receiving?

What steps have you taken to resolve the issue?

Was the site working with SSL prior to adding it to Cloudflare?
We can access the site without SSL

What are the steps to reproduce the error:

  1. access the site https://jam-dev-env.io

Have you tried from another browser and/or incognito mode?
Yes
Please attach a screenshot of the error:
attached

You can only use the Cloudflare Origin Certificate for proxied DNS records, but yours is set to DNS-Only.

1 Like

okay. thanks for the response.

I have turned ON the proxy now but the site is not accessible.

Please find below snapshot for reference. Please advise what is the best practice to use Cloudflare SSL & and are we using correct SSL certificate type or do we need to change.

Our site is hosted with cloud fare and we have the application running on Azure VM (Linux OS)with public IP address. For now we have allowed only specific public IPs only to access the website but we need the website to be available and accessible publicly over secured protocol. Hence, once we are done with testing & validation then we can publish it for everyone.

As the site is now proxied, you must allow Cloudflare’s IP addresses…

Using Cloudflare to provide SSL for an origin server that isn’t set up for it is not recommended. Otherwise data will not be encrypted between Cloudflare and the origin, but your users are deceived into thinking their data is secure when it is not.

Make sure your origin is configured for HTTPS with a valid SSL certificate and set Cloudflare’s SSL/TLS setting to “Full (strict)” so your site is secured end-to-end.

1 Like

We have allowed below listed Cloudflare IP addresses for accessibility. But when we enable proxy, we cant access the site.
Please see below and advise if we need to allow any other IP addresses.

173.245.48.0/20,
103.21.244.0/22,
103.22.200.0/22,
103.31.4.0/22,
141.101.64.0/18,
108.162.192.0/18,
190.93.240.0/20,
188.114.96.0/20,
197.234.240.0/22,
198.41.128.0/17,
162.158.0.0/15,
104.16.0.0/13,
104.24.0.0/14,
172.64.0.0/13,
131.0.72.0/22

Make sure the SSL/TLS settings are set to “Full (strict)” to ensure HTTPS requests from clients are passed as HTTPS to your server.

We have set the SSL/TLS settings to Full (Strict). We have also enabled Proxied DNS.
However after enabling Proxied DNS, we are not able to access the website.
And why does it show issued by as “GTS CA Google Trust Certificates” instead of Cloudflare after enabling Proxied DNS??

Please see the snaps below of error message with certificate details.

o

We have enabled SSL/TLS settings to Full Strict as advised and also enabled DNS Proxied.
Please see below DNS settings snap. But if we access the site, we get Host error as shown in the previous response.

We have set SSL settings to Full Strict mode as advised and enabled Proxied DNS but still cant access the site as shown in previous responses

Cloudflare is not a trusted CA, so Cloudflare gets edge certificates from Google Trust Services or LetsEncrypt. What you see is as expected.

The site is again not proxied and I can’t connect to your origin server, it times out (as in the Cloudflare message)
https://cf.sjr.org.uk/tools/check?73f46b3182da4a0a80d10f53d0162ecc#dns

Make sure you origin server is working properly again, the re-enable the proxy.

Thanks for the update and for clarifying our concern regarding Certificate authority.
We had disabled proxy since our development team wanted to work on UAT task on the site, so they could access the site over Http for time being
But we have enabled Proxied DNS again and site is not accessible now. We get same error message as shared in previous post.

Please check the status from your end and let us know.

The timeout message means Cloudflare can’t reach your origin server. Make sure you have allowed those Cloudflare IP addresses access to the server and that the list is correct.

Thanks for the update. Its working now. Site is securely accessible over https protocol.
https://cf.sjr.org.uk/tools/check

We have one further query regarding expiry of the certificate as it shows, it will expire on 8th may,2024. It shows 3 months validity. Is it due to being issued automatically by GTS? Will it automatically renew or manual intervention is required for renewal from our end?
I checked on Cloudflare portal and it displays below information for universal certificate.

*.jam-dev-env.io, jam-dev-env.io Universal Active 2024-05-08(Managed)
#### Review Universal Certificate for jam-dev-env.io, *.jam-dev-env.io

The certificates in the pack listed below are managed and auto-renewed by Cloudflare.

|Certificate|Expiration||

|SHA256 RSA|2024-05-08(Managed by Cloudflare)|

Certificate Validity Period

3 months

Certificate validation method

TXT

Certificate Authority

Google Trust Services|

Please check and advise which certificate details shall we refer to and what is recommended to ensure SSL certificates are valid and do not expire. How do we managed them

Cloudflare’s Universal SSL certificates will be renewed automatically around 30 days before the expiry date, for another 3 months.

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.