SSL not loding with the Apache webiste

[user29413]

Hi
I am Sudheer, I was created the SSL certs on “Origin Certificates”, after I configured those .key and .pem files in apache2 for my site.

While accessing the webbsites I am getting the error of “connection is not secure”, so it’s not loading with cloudflare SSL.

Please give me the solution ASAP.

Thanks,
Sudheer.K.

[fritex]

May I ask if you have saved and restarted/reloaded Apache web service after modifications?

Furthermore, are the DNS records (hostnames) proxied and set to cloud?

@user29413

Origin Certificate

I assume you used instructions provided from the below article?:

• https://developers.cloudflare.com/ssl/origin-configuration/origin-ca

May I ask what SSL option have you got selected under the SSL/TLS tab at Cloudflare dashboard for your domain ( Flexible, Full, Full Strict … )?

If using Cloudflare Origin CA Certificate, please make sure you’ve selected Full (Strict) SSL:

Why you should choose Full Strict, and only Full Strict

Unencrypted & unverified connections Imagine you open Paypal and suddenly get that warning [image] Would you continue? Probably not. For decades leaders in IT security have advocated that people upgrade their sites from unencrypted HTTP to secure HTTPS. And for a reason, everything you send via an HTTP connection is sent in plain text and can be intercepted at any point between you and the server. Equally, you’d probably not proceed if you got such a warning, right? [image] That’s when th…

[user29413]

I restarted the Apache server also and I copied two files one is .pem and .key is that correct?

[user29413]

I am configuring SSL for sub domain demo.olivetech.in

[user29413]

My edge certificate is Let’sencrypt
*.olivetech.in, olivetech.inUniversal

Active

2022-04-04(Managed)

Review Universal Certificate for *.olivetech.in, olivetech.in

The certificates in the pack listed below are managed and auto-renewed by Cloudflare.

Certificate	Expiration
SHA256 RSA	2022-04-04(Managed by Cloudflare)

Certificate Validity Period

3 months

Certificate validation method

TXT

Certificate Authority

Let’s Encrypt

[user29413]

I put Full ( Strict) mode

[sdayman]

olivetech doesn’t have DNS records.

[user29413]

yeah, I am creating for sub domain of olivetech.in and that’s called - “demo.olivetech.in”

[user29413]

yeah, I am creating for sub domain of olivetech.in and that’s called - “demo.olivetech.in”

[sdayman]

In that case, you’re almost all set. Toggle that DNS entry to Proxied and it should work.

[user29413]

If I put proxied also it’s not working and I created the certs in this folder /etc/apache2/ssl and I uploaded these certs .pem and .key is that fine?

Now I am trying for directly primary domain - olivetech.in

<VirtualHost *:80>
ServerName olivetech.in
Redirect “/” “https://olivetech.in/”
DocumentRoot /var/www/html/wordpress
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined


<VirtualHost *:443>
ServerAdmin [email protected]
DocumentRoot /var/www/html/wordpress
ServerName olivetech.in
DirectoryIndex index.php index.html
<Directory /var/www/html/wordpress/>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

SSLEngine on
SSLCertificateFile /etc/apache2/ssl/olivetech.in.pem
SSLCertificateKeyFile /etc/apache2/ssl/olivetech.in.key

[user29413]

I am getting this error You may need to install an Intermediate/chain certificate to link it to a trusted root certificate.

I am using free cloudflare account and it’s not a paid account. is that fine?
please help me with proper steps for install SSL.

[user29413]

That is my issue.

SSLEngine on
SSLCertificateFile /etc/apache2/ssl/olivetech.in.crt
SSLCertificateKeyFile /etc/apache2/ssl/olivetech.in.key
SSLCertificateChainFile /etc/apache2/ssl/origin_rsa_ca.pem

is that correct?

[sdayman]

It looks like the ‘demo’ subdomain is gone, but the apex domain olivetech.in now resolves and has the origin certificate.

@user29413

You may need to install an Intermediate/chain certificate to link it to a trusted root certificate.

Not necessary since Cloudflare trusts that certificate.

@user29413

it’s not working

“Not working” in what way? Right now it’s not proxied, so I can’t check, other than to see that it has the origin certificate.

@user29413

link it to a trusted root certificate.

You can try adding one from this:
https://developers.cloudflare.com/ssl/origin-configuration/origin-ca#2-install-origin-ca-certificate-on-origin-server

[user29413]

I am really not understanding which certificate we need to add for the domain “olivetech.in”, please give me the steps for that.

I already added the certificate in the point off 4 from the doc.

​4. (required for some) Add Cloudflare Origin CA root certificates

Some origin web servers require upload of the Cloudflare Origin CA root certificate. Click a link below to download either an RSA and ECC version of the Cloudflare Origin CA root certificate:

• Cloudflare Origin ECC PEM (do not use with Apache cPanel)
• Cloudflare Origin RSA PEM

[user29413]

@user29413

Cloudflare Origin RSA PEM

I added this certificate - SSLCertificateChainFile /etc/apache2/ssl/origin_rsa_ca.pem

I didn’t enable the Proxy why because of it’s taking the Edgecertificate and that edge certificate is including with the Let’sencrypt.