Cloudflare Origin CA certificates secure traffic between Cloudflare and a proxied origin. They are not ordinary public-browser certificates, so plan direct access and any future pause or DNS-only change before installing one.
IN THIS ARTICLE
Check access and requirements
Confirm the website will remain behind the proxy and that you can install certificate material through the hosting panel or server configuration. Preserve the existing working certificate and protect private keys.
01 Review Origin CA trust and install the certificate
- Open SSL/TLS > Origin Server and choose Create Certificate on the Origin Certificates tab.
- Use the supported generated-key or existing-CSR option, then specify the exact hostname coverage and an appropriate validity period.
- Save the certificate and private key securely when displayed. Install them at the origin using the hosting platform’s certificate workflow, including the required chain where applicable.
- Confirm the HTTPS listener works and select Full (strict) for the applicable Cloudflare traffic.
- Test through the proxied hostname and record the expiry in your own monitoring. Keep certificate keys out of public folders and source repositories.
Confirm the expected result
Cloudflare should validate the installed origin certificate and deliver the site successfully. A direct browser connection can still report an untrusted authority because Origin CA has a different trust purpose.
Resolve setup problems
If the site must be reachable directly by visitors, use an appropriate publicly trusted origin certificate instead. Replace compromised key material and the certificate through a controlled change. Do not revoke a working certificate before preparing its replacement.
Will Cloudflare remind me when this certificate expires?
Cloudflare’s current Origin CA documentation says expiry notifications are not sent for these certificates. Maintain your own certificate inventory and renewal monitoring.
.png)
 (1).jpg)
 (1) (1).png)
 (1).png)
.jpg)
.jpg)
 (1).jpg)
.jpg)
