1

All of the websites I manage use cPanel, which also offers free SSL certificates. However, some of these domains use Cloudflare for their DNS, and they also get their SSL certificates from Cloudflare itself.

For these websites, cPanel's AutoSSL feature normally fails at renewal time. I see several questions online that ask how to make sure AutoSSL works when Cloudflare is in the picture (and the solution require either editing the .htaccess file for the website, or temporarily disable Cloudflare's SSL so the AutoSSL feature can complete successfully).

My question is a different one: if I get an SSL certificate from Cloudflare already, do I even need cPanel's AutoSSL feature? Is there any scenario where I would benefit from making sure that cPanel's AutoSSL correctly renews all certificates anyway?

| improve this question | |
2

When you use cloudflare there are two connections to your website because Cloudflare acts as a proxy in the middle:

User     ------>    Cloudflare    ------>   Origin (cPanel)

Cloudflare will enable SSL between the user and Cloudflare but may leave the connection to the origin unencrypted:

User     ======>    Cloudflare    ------>   Origin

If you have SSL on the origin as well, both connections will be encrypted:

User     ======>    Cloudflare    ======>   Origin

You have several options for encrypting traffic to the origin:

  • Use AutoSSL to get a LetsEncrypt certificate. These certificates expires every few months but get auto-renewed and re-installed.
  • Get an origin certificate from CloudFlare that it trusts (but which users may not trust.) These certificates expire every 10 years and need to be manually installed.
  • Use a self signed certificate which doesn't allow you enable strict SSL mode at Cloudflare and could be vulnerable to a forgery attack.

AutoSSL is LetsEncrypt for cPanel. LetsEncrypt uses an automatic challenge response to verify that you are the owner of the domain:

  1. cPanel contacts LetsEncrypt and requests a certificate for a domain
  2. LetsEncrypt gives cPanel unique data to publish at a specific URL (under /.wellknown/acme-challenge/
  3. cPanel publishes the data
  4. LetsEncrypt validates that the data has been published, sees that you have control over domain, and gives cPanel the certificate.

When you have Cloudflare, all the requests first hit Cloudflare before hitting your website. Cloudflare should pass through the Acme Challenge requests and you should be able to get a LetsEncrypt certificate, even when Cloudflare is in the middle.

| improve this answer | |
  • 1
    In my honest opinion, it's far easier just to use Cloudflare Origin SSL installed locally, since it has a 10+ year expire time, once it's installed, little can go wrong while LetsEncrypt has to install many times over many years, to me, that increases risk of failure. I know that's not the question, but wonder why so many who use cPanel with Cloudflare bother with LetsEncrypt. – Simon Hayter♦ Mar 11 '19 at 18:10
  • @SimonHayter Thanks for pointing that out, I've added info to the answer about origin certificates. – Stephen Ostermiller♦ Mar 11 '19 at 22:15
  • @SimonHayter I didn't even know that was an option, but this looks like the best solution for me. If I can move all the management over to Cloudflare I would prefer it, rather than going back and forth between different cPanel's. I think a lot of people use LetsEncrypt just because it comes automatically through cPanel so it makes you think that, well, you have to use it – user1301428 Mar 12 '19 at 10:00
  • CA Bundle can be found here: bybe.net/setting-up-your-cpanel-website-with-cloudflare-ssl otherwise you have to search their site for it as strangely they do not provide it when they issue your keys. – Simon Hayter♦ Mar 14 '19 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.