A certificate issued by Cloudflare for the connection between Cloudflare and your server.
WHAT IT IS
Cloudflare can issue a long-lived certificate for your origin server. It is trusted by Cloudflare but not by browsers.
WHEN IT IS USEFUL
If you want Full (strict) mode without relying on AutoSSL renewals reaching the origin If your origin is not publicly reachable, so AutoSSL cannot validate
INSTALLING ONE
Generate it in the Cloudflare dashboard, then install the certificate and key through cPanel > SSL/TLS > Manage SSL sites.
THE IMPORTANT CAVEAT
An origin certificate is not trusted by browsers. If a visitor ever reaches your server directly, bypassing Cloudflare, they see a certificate warning.
That includes anyone who discovers your origin IP address.
THE SIMPLER OPTION
Use AutoSSL, which produces a publicly trusted certificate that works whether traffic arrives through Cloudflare or directly. Set Cloudflare to Full (strict) and everything works.
For most accounts this is the better choice.
