I am using cPanel 92 on CentOS 7 and my domain.com's DNS zone is running on Cloudflare (free Cloudflare tier) and I'm having trouble getting my subdomains (of a subdomain) running over HTTPS. Security isn't important as no sensitive information is involved, but user trust is paramount so I can't have security warnings.
- Configured a wildcard subdomain (of a subdomain) on a user on cPanel (*.tech.domain.com)
- Installed the Let's Encrypt AutoSSL provider on WHM
- Created an entry in my domain.com's DNS zone on Cloudflare for '*.tech'
- Experimented with enabling/disabling the proxy of the traffic in Cloudflare (often just leaving Cloudflare acting purely as a DNS zone)
- Experimented with adding a page rule for *.tech.domain.com setting the SSL option to 'Flexible' as it is 'Full' by default for domain.com.
Unfortunately I haven't once managed to get any subdomain loading without a security warning. Often, the subdomain refuses to load completely due to 'ERR_SSL_VERSION_OR_CIPHER_MISMATCH'. Other times I've had it loading, but throwing a warning as it is running on a self-signed cert.
I've read that I may not be able to do it the above way because the active DNS zone for domain.com needs to be the one running on the server so that AutoSSL can add the appropriate verification records to the zone. I don't fully understand if this is the case because AutoSSL seems to work for other subdomains on the server that don't use the server's DNS zone.
I've tried the 'Generate a new SSL certificate and signing request' three times and I'm not sure if I'm now supposed to wait to hear back from Let's Encrypt? Apparently there is, or once was, an interface to review pending cert requests to the CA, but I don't see such an interface anywhere to check whether or not there is anything pending.
I don't care that much if the traffic is encrypted between Cloudflare and my server. I don't care that much if the certificate the browser sees is a cPanel one, a Let's Encrypt one or a Cloudflare one, I just want it to look secure for the end-user. I'm happy to manage this manually and upload a new cert (and repeat quarterly/annually) if needs be.
I'm a bit lost here as I'm not really familiar with how this all works, any advice/guidance would be appreciated.