3

I'm using Cloudflare's self-signed certificates to encrypt traffic between Cloudflare and my origin web server. A problem that cPanel shows a No Valid Certificate for the domain and the error SELF_SIGNED_CERT_IN_CHAIN. enter image description here

SSL/TLS Status shows as “Unknown Certificate Type”.

This posts (1, 2) say Origin Certs are only recognized by Cloudflare for sites proxied by Cloudflare and host might need the Cloudflare Root CA (Step 4) to verify the cert on server... But I don’t know how to import an CF RSA PEM key in WHM. As far as I understand, this certificate should be displayed in SSL Storage Manager, but I do not know how to upload it from WHM. I tried to upload an "origin_ca_rsa_root.pem" file manually to several server directories:

/usr/local/cpanel/etc/
/etc/ssl/certs

But it didn't help

Improve this question
6
  • 1
    Is this status affecting your website's ability to serve up the Origin certificate, or is it a warning you can ignore?
    – Maximillian Laumeister ♦
    Oct 6, 2021 at 19:45
  • @MaximillianLaumeister Yes, this problem partially affects site's ability. I am using WordPress and in this case I get a few errors because of this: 1. REST API error. cURL error 60: SSL certificate problem: self signed certificate in certificate chain 2. Site could not complete a Loopback requests. Also cURL 60 error.
    – Alexius The Coder
    Oct 7, 2021 at 10:23
  • You can use curl --insecure to bypass the certificate checks when you run it against the WordPress API.
    – Stephen Ostermiller ♦
    Oct 7, 2021 at 23:17
  • @StephenOstermiller Yes, but what about plugins that use curl? i can't change their code. I found this controversial solution stackoverflow.com/a/12688835/5385052. but this seems to be a bad idea for a production site
    – Alexius The Coder
    Oct 8, 2021 at 10:59
  • What plugins are you using that call your own site via API? Can you configure them to route API requests through Cloudflare (using your real domain name which has a valid cert)?
    – Stephen Ostermiller ♦
    Oct 8, 2021 at 11:22

1 Answer 1

Reset to default
2

When you are using a self-signed certificate, it is not supposed to be valid and it doesn't need to be valid. The only client that needs to trust it is Cloudflare. In fact, it might be desirable to use certificate on your origin server that isn't trusted by users as a way of discouraging access directly to your origin server. In other words, this warning from WHM is expected and you can ignore it.

It is possible to make your web server trust that certificate. However, importing Cloudflare's self-signing root certificate into your server's trust store will cause most programs that run on the server to trust ALL of Cloudflare's self-signed certificates. Cloudflare issues these self-signed certs willy nilly and they are not meant to be trusted. Trusting all Cloudflare self-signed certificates is a security risk. It opens your web server up to man-in-the-middle attacks for every HTTPS request that your server makes.

If WHM won't serve your site with a self-signed certificate (I don't think that is actually the case), you have no choice but to add the root certificate to your trust store. This page has instructions for installing root certificates for various operating systems and browsers. To install a new root certificate on a Linux server, you would use the commands:

sudo mkdir /usr/local/share/ca-certificates/extra
sudo cp root.cert.pem /usr/local/share/ca-certificates/extra/root.cert.crt
sudo update-ca-certificates
Improve this answer
3
  • Thanks for replay, I also found this post with tutorial how to install an additional cert on server superuser.com/a/719047
    – Alexius The Coder
    Oct 12, 2021 at 20:46
  • I found a solution for myself in which there is no need to add a certificate to the server. I am using Wordpress, as it turned out it uses its own certificate bundle in "wp-includes/certificates" folder in certs chain. So you can get rid of cURL error 60 by adding Cloudflare root certificate information to this file. I have only one question, how safe is it, can there be threats like a man in the middle or else?
    – Alexius The Coder
    Oct 13, 2021 at 15:26
  • 1
    That sounds fine to me. You aren't changing it so that clients (like curl) trust certificates that aren't meant to be trusted. It sounds like your plugin is trusting the wordpress cert for this request (and probably not for all requests.)
    – Stephen Ostermiller ♦
    Oct 13, 2021 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.