Your browser does not seem to support JavaScript. As a result, your viewing experience will be diminished, and you have been placed in read-only mode.

Please download a browser that supports JavaScript, or enable it if it's disabled (i.e. NoScript).

Cloudflare SSL - Do You Use Or Not?

IT Discussion

1.8k

B

black3dynamite @FATeknollogee
last edited by

@FATeknollogee said in Cloudflare SSL - Do You Use Or Not?:

dns-01

Not sure what that is but could this help?

Cloud Flare hook bash for dehydrated - DNS-01 Challenge Let's Encrypt
https://github.com/sineverba/cfhookbash
1 Reply Last reply
Reply Quote 0
T

travisdh1 @FATeknollogee
last edited by
@FATeknollogee said in Cloudflare SSL - Do You Use Or Not?:

I use CF for DNS & as domain registrar.
My web hosting is done somewhere else.

I'm trying to use LE certs (at my web hoster) but the dns-01 validation is failing.

What am I doing wrong?

You'll need a cloudflare api key and the registered email in a file. Mine is in /root/.secrets/cloudlfare.ini, which has 2 lines
```
dns_cloudflare_email = [email protected]
dns_cloudflare_api_key = your key
```
Then you can:
```
certbot2 certonly --dns-cloudflare-credentials /root/.secret/cloudflare.ini --renew-by-default -d domain.com -d subdomain.domain.com
```
You do have to list all domains and subdomains you want the cert to be valid for in the command. I have mine scripted to run once every day.
D 1 Reply Last reply
Reply Quote 0
D

dbeato @travisdh1
last edited by
@travisdh1 said in Cloudflare SSL - Do You Use Or Not?:
@FATeknollogee said in Cloudflare SSL - Do You Use Or Not?:

I use CF for DNS & as domain registrar.
My web hosting is done somewhere else.

I'm trying to use LE certs (at my web hoster) but the dns-01 validation is failing.

What am I doing wrong?

You'll need a cloudflare api key and the registered email in a file. Mine is in /root/.secrets/cloudlfare.ini, which has 2 lines
```
dns_cloudflare_email = [email protected]
dns_cloudflare_api_key = your key
```
Then you can:
```
certbot2 certonly --dns-cloudflare-credentials /root/.secret/cloudflare.ini --renew-by-default -d domain.com -d subdomain.domain.com
```
You do have to list all domains and subdomains you want the cert to be valid for in the command. I have mine scripted to run once every day.
Yep, I have it that way for my home as I cannot get SSL since my ISP blocks port 80.
1 Reply Last reply
Reply Quote 0
J

JaredBusch
last edited by

I just don't wan tto take the time to convert everything. I have been using LE for so long...
B 1 Reply Last reply
Reply Quote 0
B

black3dynamite @JaredBusch
last edited by

@JaredBusch said in Cloudflare SSL - Do You Use Or Not?:

I just don't wan tto take the time to convert everything. I have been using LE for so long...

Why would you have to convert? Is this a new way of getting certs now?
J 1 Reply Last reply
Reply Quote 0
F

FATeknollogee
last edited by FATeknollogee

@dbeato @travisdh1
Are you guys doing this on a VPS or you have a self-hosted web server?
T D 2 Replies Last reply
Reply Quote 0
T

travisdh1 @FATeknollogee
last edited by

@FATeknollogee said in Cloudflare SSL - Do You Use Or Not?:

@dbeato @travisdh1
Are you guys doinf this on a VPS or you have a self-hosted web server?

Mine is a self hosted server with an nginx proxy handling all external traffic. Should work the same with a VPS when using cloudflare for DNS.
1 Reply Last reply
Reply Quote 0
J

JaredBusch @black3dynamite
last edited by

@black3dynamite said in Cloudflare SSL - Do You Use Or Not?:

@JaredBusch said in Cloudflare SSL - Do You Use Or Not?:

I just don't wan tto take the time to convert everything. I have been using LE for so long...

Why would you have to convert? Is this a new way of getting certs now?

Yes. This would allow us to use CloudFlare again. When I first switched to LE, I had to manually disable CloudFlare (uncheck the orange cloud), wait a minute, then run the LE renew, then reenable CloudFlare.

Certbot eventually came out with a plugin that you could use the CloudFlare API to enable, and disable during the process. But, by then, I had already just disabled CloudFare proxying all my sites that use LE.

Now, with DNS verificaiton, I can turn everything back on and not even need the API to enable/disable. But I will need to take the time to set things back up again.
1 Reply Last reply
Reply Quote 1
B

Baldwin_Cannon
last edited by Baldwin_Cannon

In principle, the combination of both will be appropriate for better safety of the web site. Only along with the above, I also use other types of SSL such as there https://hostovita.pl/ssl/
1 Reply Last reply
Reply Quote 0
S

stacksofplates
last edited by

I use the actual CloudFlare certs that they give you also. Not just clicking the cloud. I use GitLab pages to host my blog and LetsEncrypt renewal is still manual there. So I got a free cert from CloudFlare which is good for 15 years and used that instead.
B 1 Reply Last reply
Reply Quote 0
D

dbeato @FATeknollogee
last edited by

@FATeknollogee said in Cloudflare SSL - Do You Use Or Not?:

@dbeato @travisdh1
Are you guys doing this on a VPS or you have a self-hosted web server?

On both.
1 Reply Last reply
Reply Quote 0
B

black3dynamite @stacksofplates
last edited by

@stacksofplates said in Cloudflare SSL - Do You Use Or Not?:

I use the actual CloudFlare certs that they give you also. Not just clicking the cloud. I use GitLab pages to host my blog and LetsEncrypt renewal is still manual there. So I got a free cert from CloudFlare which is good for 15 years and used that instead.

Are you talking about the Universal SSL (Shared) or the Origin Certficates?
S 1 Reply Last reply
Reply Quote 0
S

stacksofplates @black3dynamite
last edited by

@black3dynamite said in Cloudflare SSL - Do You Use Or Not?:

@stacksofplates said in Cloudflare SSL - Do You Use Or Not?:

I use the actual CloudFlare certs that they give you also. Not just clicking the cloud. I use GitLab pages to host my blog and LetsEncrypt renewal is still manual there. So I got a free cert from CloudFlare which is good for 15 years and used that instead.

Are you talking about the Universal SSL (Shared) or the Origin Certficates?

Origin.
1 Reply Last reply
Reply Quote 2

2 / 2