1

We have a domain that is running behind Cloudflare that we would also like to have a valid (and free) SSL certificate on the origin server (running cPanel with AutoSSL).

Currently the AutoSSL script is returning errors about not being able to verify the domain. Does anyone know how this can be setup?

The domain is setup on Cloudflare direct via cloudflare.com, not via the cPanel plugin (which has never worked quite as well).

Here's the error if that's useful:

DNS DCV: The DNS query to “_cpanel-dcv-test-record.____________” for the DCV challenge returned no “TXT” record that matches the value “_cpanel-dcv-test-record=RiWJEVG___________”.; HTTP DCV: The system queried for a temporary file at “https://www.____________/.well-known/pki-validation/B3ECBB8664__________.txt”, which was redirected from “http://____________/.well-known/pki-validation/B3ECBB8664__________.txt”. The web server responded with the following error: 403 (Forbidden). A DNS (Domain Name System) or web server misconfiguration may exist. The domain “____________” resolved to an IP address “104.27.x.x” that does not exist on this server.

Improve this question
2
  • Any reason why you want to use the AutoSSL? considering Cloudflare certs are good until the year 2030+
    – Simon Hayter
    Feb 26, 2019 at 8:03
  • Yeah in most cases the Cloudflare one alone is enough, but in one case our client needs to bypass Cloudflare and access the origin server directly, whereby we also want a valid certificate to avoid errors.
    – Simon East
    Feb 27, 2019 at 22:23

2 Answers 2

Reset to default
1

I've found that turning "Always use HTTPS" setting OFF in Cloudflare allows AutoSSL to validate correctly. Something about the 301 redirect that Cloudflare returns can break the certificate validation process.

It's still possible to enforce HTTPS for users via an .htaccess rule, instead of the Cloudflare setting.

It may also be possible to enable/disable the Cloudflare setting selectively via a page rule, but I haven't explored the ramifications of that yet.

Improve this answer
1

A problem with using Cloudflare Origin Certificates with cPanel's AutoSSL is that AutoSSL runs automatically for the domains that are marked as "included for AutoSSL" on cPanel.

When it finds a DCV error, it removes the Cloudflare Origin certificate and tries to set up AutoSSL for that domain, with no success. In this case, If you're using Full (strict) SSL settings on Cloudflare, your site breaks with an "invalid SSL certificate" message from Cloudflare.

To use Cloudflare's certificates with cPanel, you first need to exclude your domain from AutoSSL, and you can only do that if you have a successful AutoSSL run on that domain to begin with.

To prevent cPanel's AutoSSL from removing your Cloudflare certificate automatically (on Godaddy shared hosting it runs once a day, for example), you need to:

  • Pause Cloudflare for that domain (bottom right on Cloudflare's dashboard)
  • Uninstall current certificates for your domain on cPanel/Manage SSL Sites (.../ssl/install.html)
  • Run AutoSSL for your domain on cPanel/SSL/TLS Status (.../security/tls_status)
  • Now you can choose to exclude your domain (and subdomains) from AutoSSL (same page as above)
  • Install Cloudflare's Origin certificate on your domain again (cPanel SSL/TLS)
  • Set Cloudflare SSL for Full (Strict) (or what you wish)
  • Unpause Cloudflare

With this setting, AutoSSL won't run for your domain anymore, and the Origin Certificate will remain installed correctly.

I read in some other forums users talking about reinstalling every 90 days, but removing the domain from cPanel's AutoSSL is a perfect fix to install and keep your Cloudflare's certificates working.

Hope it helps someone out there who's battling with Cloudflare SSL and cPanel's AutoSSL!

Improve this answer
1
  • 1
    I realise the original question intends to use AutoSSL alongside with Cloudflare, and I suppose it would generate the problem I am offering the solution to. I believe in order to temporarily access the server with another certificate, one would have to pause Cloudflare temporarily, issue an AutoSSL certificate or set up Cloudflare's SSL in a way that it does not require an Cloudflare Certificate to communicate with the origin server.
    – Eduardo
    Aug 23, 2021 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.