I created Origin Certificate in cloudflare and installed on my Apache on Debian VPS using the guide https://support.cloudflare.com/hc/en-us/articles/217472077.

My URL is like this: https://socket.mydomain.com/

I am getting warning "There are issues with the site's certificate chain (net::ERR_CERT_AUTHORITY_INVALID)." whenever I visit above URL, why? Remember that I am not using old versions of browsers. Tell me what I am doing wrong?


CloudFlare's Origin CA is working as intended. It's not trusted by browsers. It's only trusted by CloudFlare's servers. Its purpose is to secure communications between CloudFlare and your origin, not for general usage.

Reference: Introducing CloudFlare Origin CA

If you want a free, publicly trusted certificate, check out Let's Encrypt. (It's a legitimate and widely-used CA. It's a non-profit founded by the EFF, Mozilla, and several universities and Internet companies.)

  • Actually you don't have to go to another website to get a free publicly trusted certificate. Cloudflare itself has this. The OP only has to enable the orange cloud next to his/her DNS record pointing to the VPS. That's it. – Anoyz Jul 30 at 14:33
  • @Anoyz But the origin server needs a trusted certificate -- either from a public CA or from the Origin CA -- in order to secure the connection between Cloudflare and the origin. – Matt Nordhoff Jul 31 at 15:11
  • Yes, which cloudflare gives. You can find the option under the menu "Crypto" on cloudflare. – Anoyz Aug 2 at 19:08

The SSL warnings should go away if you turn on Cloudflare's reverse proxy ("orange-cloud" the DNS record that points to your Debian VPS). You will be presented Cloudflare's browser-trusted Edge certificate when you request your URL.

For fully encrypted end-to-end connection, use the "Full (strict)" SSL setting in Cloudflare's Crypto tab. This way connections between end-users and the proxy will use the Edge certificate, and those between the proxy and your Debian VPS will use the Origin certificate.

Reference: Introducing CloudFlare Origin CA, same page referenced in @matt-nordhoff's answer. Here's an excerpt from that page:

When pausing CloudFlare or gray-clouding individual zones, be aware that you and your visitors may receive errors in their browsers until you orange-cloud (reverse proxy) them again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.