# Cloudflare Origin Certificate

Source: https://flywp.com/docs/site/custom-ssl-management/cloudflare-origin-certificate/

## Auto SSL Provisioning with Cloudflare Origin Certificate (Connected Domains)

This guide explains how to automatically provision SSL certificates using **Cloudflare Origin CA** for domains connected to your FlyWP server.

## Overview

Cloudflare Origin Certificates are designed to secure traffic **between Cloudflare and your server**, not between the visitor and Cloudflare. This means:

- Visitors connect securely to Cloudflare (Edge SSL)
- Cloudflare connects securely to your origin server (Origin SSL via FlyWP)

This setup is **fast, automated, and avoids rate limits** often encountered with Let’s Encrypt.

## Requirements

Before proceeding, ensure:

- [Your domain is **added to Cloudflare** (Follow this doc)](https://flywp.com/docs/account/integrations/how-to-integrate-cloudflare/)
- DNS records are set to **Proxied (orange cloud ☁️)**
- SSL mode in Cloudflare is set to **Full (strict)**
- Your domain is already **connected inside FlyWP** **through Cloudflare integration.**

## Step-by-Step Setup

1. Go to your site in **FlyWP Dashboard**
2. Navigate to **SSL → Add New Certificate**
3. Select **Cloudflare Origin CA**
4. Choose your connected Cloudflare account
5. Click **Generate & Install**

![Image](https://flywp.com/wp-content/uploads/2026/04/image-16-1024x550.png)

FlyWP will:

- Generate a Cloudflare Origin Certificate via API
- Install it on your server
- Configure your web server automatically

## API Authentication Options

### Option 1 (Recommended): Global API Key

**Why recommended:**

- Simple setup
- No permission misconfiguration
- Works reliably with FlyWP automation

**Steps:**

1. [Go to Cloudflare → Profile → API Tokens](https://dash.cloudflare.com/profile/api-tokens)
2. Copy **Global API Key**
3. Use it when connecting Cloudflare account in FlyWP

![Image](https://flywp.com/wp-content/uploads/2026/04/image-18-1024x416.png)

### Option 2: Granular API Token (Advanced)

If you prefer tighter security, create a scoped token.

**Required Permissions:**

| Permission | Access |
| --- | --- |
| Zone: DNS | Edit |
| Zone: SSL and Certificates | Edit |

![Image](https://flywp.com/wp-content/uploads/2026/04/image-15-1024x447.png)

**Zone Resources:**

- Include the specific domain(s) you want to manage

⚠️ Missing any of these permissions will cause the following:

- Certificate generation failure
- Installation errors in FlyWP

## Best Practices

- Always use **Full (strict)** SSL mode
- Keep DNS records **proxied**
- Avoid mixing Cloudflare Origin SSL with Let’s Encrypt on the same domain
- Do not expose your origin IP publicly

## Important Warning

Cloudflare Origin Certificates are:

- ❌ **NOT trusted by browsers directly**
- ✅ Only trusted when traffic passes through Cloudflare

If you disable Cloudflare proxy (grey cloud), your site will show SSL errors.

## Common Issues & Fixe

### 1. SSL Error: “Invalid Certificate” (525 / 526)

**Cause:**

- SSL mode not set correctly

**Fix:**

- [Go to Cloudflare → SSL/TLS (Click Here)](https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls)
- Set mode to **Full (strict)**

![Image](https://flywp.com/wp-content/uploads/2026/04/image-9-1024x414.png)

![Image](https://flywp.com/wp-content/uploads/2026/04/image-10-1024x473.png)

### 2. Site Not Loading Over HTTPS

**Cause:**

- DNS not proxied through Cloudflare

**Fix:**

- [Go to DNS settings (Click Here)](https://dash.cloudflare.com/?to=/:account/:zone/dns/records)
- Ensure records show **orange cloud (Proxied)**

![Image](https://flywp.com/wp-content/uploads/2026/04/image-11.png)

### 3. API Permission Error

**Cause:**

- API token lacks required permissions

**Fix:**

- [Visit Cloudflare API](https://dash.cloudflare.com/profile/api-tokens) page
- Ensure token includes:
  - Zone: `SSL and Certificates: Edit`
  - `Zone: `DNS : Edit
  - Zone Resources: All Zones (optional)

![Image](https://flywp.com/wp-content/uploads/2026/04/image-12-1024x447.png)

### 4. Mixed Content Warnings

**Cause:**

- Site still serving HTTP assets

**Fix:**

- Enable **Automatic HTTPS Rewrites** in Cloudflare
- Or fix URLs in your app/database

### 5. Direct IP Access Shows SSL Error

**Cause:**

- Origin certificate is not publicly trusted

**Fix:**

- This is expected behavior
- Always access via your domain (through Cloudflare) by enabling Proxy Mode

![Image](https://flywp.com/wp-content/uploads/2026/04/image-13.png)

## When NOT to Use Cloudflare Origin Certificates

Avoid this method if:

- You need SSL without Cloudflare proxy
- You want direct server access via HTTPS
- You are using services that bypass Cloudflare

In those cases, use **Let’s Encrypt** instead.

## Summary

Cloudflare Origin SSL in FlyWP provides:

- ⚡ Fast provisioning
- 🔒 Strong encryption between Cloudflare and server
- 🚫 No rate limits

But it requires correct Cloudflare configuration to avoid errors.