Cloudflare Origin Certificate: 15-Year SSL for Servers

A Cloudflare Origin Certificate is a free SSL certificate signed by the Cloudflare CA. It's valid for up to 15 years and requires no auto-renewal. It's used instead of Let's Encrypt to simplify management.

Differences from Let's Encrypt

Creating an Origin Certificate

SSL/TLS → Origin Server → Create Certificate:

• Hostnames: example.com, *.example.com
• Certificate Validity: 15 years
• Key type: RSA (2048) or EC (P-256)

Download: Certificate (.pem) and Private Key (.key).

Installing on Nginx

# Save the files
sudo cp origin_cert.pem /etc/ssl/cloudflare/cert.pem
sudo cp private_key.key /etc/ssl/cloudflare/key.pem
sudo chmod 600 /etc/ssl/cloudflare/key.pem

# Nginx config
server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate /etc/ssl/cloudflare/cert.pem;
    ssl_certificate_key /etc/ssl/cloudflare/key.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
}

Installing on Apache

<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile /etc/ssl/cloudflare/cert.pem
    SSLCertificateKeyFile /etc/ssl/cloudflare/key.pem
</VirtualHost>

Common mistakes when installing an Origin Certificate

Almost every Origin Certificate problem comes down to three causes: a stale certificate file, a mismatched key pair, or trying to reach the server around Cloudflare.

526 Invalid SSL certificate

Cloudflare received a certificate from the origin that it can't validate: it has expired, the hostname doesn't match the domain in the request, or the server has a certificate for a different domain installed. Check that ssl_certificate in Nginx points to the actual Origin Certificate files, not an old Let's Encrypt one.

nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/ssl/cloudflare/key.pem") failed (SSL: error:0B080074:x509 certificate routines: X509_check_private_key:key values mismatch)

The private key doesn't match the certificate — typical when an Origin Certificate is recreated in the Cloudflare dashboard without replacing both files on the server. The Origin Certificate and Private Key are issued once, as a pair; after reissuing, the old key becomes useless, so download and replace both files together.

NET::ERR_CERT_AUTHORITY_INVALID

The browser shows this error when connecting directly to the server's IP address, or to a domain with proxying turned off (a grey cloud in the DNS record). The Origin Certificate is signed by Cloudflare's internal CA and isn't included in browsers' trusted root certificate lists — it's only valid when traffic passes through the Cloudflare proxy.

RSA or ECDSA: which key type to choose

For a typical site on Nginx or Apache, the difference is unnoticeable in practice — choose RSA if you're unsure, because literally every client supports it, including old libraries on corporate networks.

When an Origin Certificate doesn't fit

Don't use an Origin Certificate if you plan to turn off Cloudflare proxying (grey cloud) for any subdomain — for example, a mail server or an API that clients reach directly by IP. Those cases need a certificate that browsers and mail clients trust on their own: Wildcard SSL via Let's Encrypt. An Origin Certificate is also useless for checks by external scanners like SSL Labs — they connect to the server directly and will report "certificate not trusted," even though everything works fine for real visitors going through Cloudflare.

How to verify the result

Don't trust the padlock icon in the browser alone — it shows a lock either way as long as proxying is on, even if the certificate on the origin server is broken.

# Check the certificate directly on the origin server, bypassing Cloudflare
curl -vI --resolve example.com:443:YOUR_SERVER_IP https://example.com/ 2>&1 | grep -i "subject\|issuer"

# Check that Cloudflare serves the public certificate
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -issuer

The first command should show the issuer as "CloudFlare Origin SSL Certificate Authority" — that confirms the server has the Origin Certificate installed. The second command, run from outside, shows Cloudflare's public certificate (Let's Encrypt or Google Trust Services) — that's expected, since end users never see the Origin Certificate at all.

Frequently asked questions

Does an Origin Certificate need renewing the way a Let's Encrypt certificate does?

Regular renewal like Let's Encrypt is not required — an Origin Certificate's validity is measured in years rather than months. That does not mean dropping oversight entirely: the certificate still has an expiry date, so it is worth setting a single calendar reminder so the expiration never arrives as a surprise long after installation.

Can the same Origin Certificate be installed on several servers at once?

Yes, one certificate can be installed on multiple servers sitting behind the same domain in Cloudflare, for example on every node behind a load balancer. The certificate places no limit on server count; what matters is copying both files, the certificate and the private key, to each server and keeping them under equally strict access permissions everywhere they are stored.

What happens to a site if Cloudflare proxying is suddenly turned off for a domain that already has an Origin Certificate installed?

Visitors' browsers immediately start showing an untrusted-certificate error, because an Origin Certificate is signed by Cloudflare's internal certificate authority and is only recognized through proxied traffic. The site technically keeps answering requests, but ordinary visitors can no longer reach it due to the security warning until proxying is turned back on or a separate, publicly trusted certificate is installed.

Can an Origin Certificate be installed through a hosting control panel instead of by hand?

It depends on the specific control panel: some hosting panels let you paste a ready-made certificate and key into the matching interface fields without editing configuration files manually, while others offer no such option. Either way, the certificate and key must first be generated in the Cloudflare dashboard, then transferred to the server using whatever method the chosen panel supports.