We have a domain that is running behind Cloudflare that we would also like to have a valid (and free) SSL certificate on the origin server (running cPanel with AutoSSL).

Currently the AutoSSL script is returning errors about not being able to verify the domain. Does anyone know how this can be setup?

The domain is setup on Cloudflare direct via cloudflare.com, not via the cPanel plugin (which has never worked quite as well).

Here's the error if that's useful:

DNS DCV: The DNS query to “_cpanel-dcv-test-record.____________” for the DCV challenge returned no “TXT” record that matches the value “_cpanel-dcv-test-record=RiWJEVG___________”.; HTTP DCV: The system queried for a temporary file at “https://www.____________/.well-known/pki-validation/B3ECBB8664__________.txt”, which was redirected from “http://____________/.well-known/pki-validation/B3ECBB8664__________.txt”. The web server responded with the following error: 403 (Forbidden). A DNS (Domain Name System) or web server misconfiguration may exist. The domain “____________” resolved to an IP address “104.27.x.x” that does not exist on this server.

  • Any reason why you want to use the AutoSSL? considering Cloudflare certs are good until the year 2030+ – Simon Hayter Feb 26 '19 at 8:03
  • Yeah in most cases the Cloudflare one alone is enough, but in one case our client needs to bypass Cloudflare and access the origin server directly, whereby we also want a valid certificate to avoid errors. – Simon East Feb 27 '19 at 22:23

I've found that turning "Always use HTTPS" setting OFF in Cloudflare allows AutoSSL to validate correctly. Something about the 301 redirect that Cloudflare returns can break the certificate validation process.

It's still possible to enforce HTTPS for users via an .htaccess rule, instead of the Cloudflare setting.

It may also be possible to enable/disable the Cloudflare setting selectively via a page rule, but I haven't explored the ramifications of that yet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.