Ssl origin cert chain of trust issue

[bkelly]

Answer these questions to help the Community help you with Security questions.

What is the domain name?
coastsystems.net

Have you searched for an answer?
google neo4j, cloudfare

Please share your search results url:

[https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/#4-required-for-some-add-cloudflare-origin-ca-root-certificates](https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/#4-required-for-some-add-cloudflare-origin-ca-root-certificates)

[neo4j](https://neo4j.com/docs/operations-manual/current/security/ssl-framework/)

[stackoverflow](https://stackoverflow.com/questions/62068801/how-to-build-a-correct-ca-chain-using-cloudflare-oigin-certificates)

Describe the issue you are having:
I have downloaded and installed the public and private origin server certificates and configured the neo4j web server to point to these certs. The web server starts but I get an untrused ‘not secure’ message in my recent chrome browser. using the testssl utility I get a ‘trust chain incomplete’ error.
Looking that the link in your docs for server configuration for nginx, I noted the section to ‘cat’ their ca.cert file with the origin file. I downloaded this:

[cloudfare ca](https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/#4-required-for-some-add-cloudflare-origin-ca-root-certificates)

and ‘cat/bundled’ it with my public.crt file. In that case I now get a ‘self signed certificate’ message from testssl.

What error message or number are you receiving?
‘Chain of trust incomplete’
‘Self signed certificate’ block

How can I proceed to the the proper chain of trust?

[DarkDeviL]

Your site looks fine from here, so it looks like you may already have resolved the issue?

Anyway, -

Origin Certificates is supposed to assist in securing the connection between the Cloudflare network and your server, when you use (Proxied) DNS records.

They won’t work (appear as trusted) when your records are (Unproxied / DNS only).

I therefore believe you solved the issue by switching the DNS record from to ?