The most common cause of AutoSSL failing on an otherwise working site.
WHY IT CONFLICTS
When a record is proxied through Cloudflare, requests to your domain reach Cloudflare rather than our server. AutoSSL's validation request may therefore never arrive, or may be answered by Cloudflare instead.
THE FIX
- In Cloudflare, set the A record for the domain and www to DNS-only, the grey cloud.
- Wait a few minutes.
- Run AutoSSL in cPanel.
- Once issued, re-enable proxying if you want it.
THE SETTING THAT MATTERS AFTERWARDS
Cloudflare SSL/TLS mode must be Full (strict) once a valid certificate exists on our server. Flexible causes redirect loops, and Full without strict accepts an invalid origin certificate.
MAIL RECORDS
Must always be DNS-only. Proxying mail records breaks both mail delivery and the mail certificate.
AN ALTERNATIVE
Cloudflare provides its own certificate for traffic between visitors and Cloudflare. You still need a valid certificate on our server for the connection between Cloudflare and us, which is what Full (strict) verifies.
