When you use cloudflare there are two connections to your website because Cloudflare acts as a proxy in the middle:
User ------> Cloudflare ------> Origin (cPanel)
Cloudflare will enable SSL between the user and Cloudflare but may leave the connection to the origin unencrypted:
User ======> Cloudflare ------> Origin
If you have SSL on the origin as well, both connections will be encrypted:
User ======> Cloudflare ======> Origin
You have several options for encrypting traffic to the origin:
- Use AutoSSL to get a LetsEncrypt certificate. These certificates expires every few months but get auto-renewed and re-installed.
- Get an origin certificate from CloudFlare that it trusts (but which users may not trust.) These certificates expire every 10 years and need to be manually installed.
- Use a self signed certificate which doesn't allow you enable strict SSL mode at Cloudflare and could be vulnerable to a forgery attack.
AutoSSL is LetsEncrypt for cPanel. LetsEncrypt uses an automatic challenge response to verify that you are the owner of the domain:
- cPanel contacts LetsEncrypt and requests a certificate for a domain
- LetsEncrypt gives cPanel unique data to publish at a specific URL (under
/.wellknown/acme-challenge/
- cPanel publishes the data
- LetsEncrypt validates that the data has been published, sees that you have control over domain, and gives cPanel the certificate.
When you have Cloudflare, all the requests first hit Cloudflare before hitting your website. Cloudflare should pass through the Acme Challenge requests and you should be able to get a LetsEncrypt certificate, even when Cloudflare is in the middle.