Making certificates issue correctly.
THE PROBLEM
AutoSSL validates a domain by placing a file on your site and requesting it.
If Cloudflare proxies the request and serves a cached response or blocks it, validation fails and the certificate does not issue.
THE SYMPTOM
AutoSSL reporting failure, and browsers warning about the certificate.
THE FIXES
Set the SSL mode to Full (strict), which requires a valid certificate at our end and gives you a reason to fix it.
Create a page rule bypassing cache and security for the validation path, so those requests reach us unmodified.
Or temporarily set the record to DNS only, run AutoSSL, and proxy it again.
WHY YOU STILL NEED OUR CERTIFICATE
Cloudflare's certificate covers the visitor to Cloudflare. The connection from Cloudflare to us needs its own.
Full (strict) validates that. Without a valid certificate at our end, strict mode fails.
CLOUDFLARE ORIGIN CERTIFICATES
Cloudflare can issue a certificate for the connection to us, valid for years.
That works, and AutoSSL is simpler for most people since it is automatic.
CHECKING
cPanel > SSL/TLS Status shows the state per domain.
