This article is a localized edition of the Japanese original. Read the Japanese original
A site served through Cloudflare has two certificates: one between the visitor and Cloudflare (the edge) and one between Cloudflare and your server (the origin), and you need to think about automating each separately. On the edge side, Cloudflare issues and renews the certificate automatically once you enable the proxy. On the origin side, the practical options are to use a Cloudflare Origin CA certificate, or to renew Let's Encrypt automatically with DNS validation (certbot-dns-cloudflare). This article explains how to choose between the two methods, the setup steps, and how to check when renewal stops.
There are two certificates
When you enable the Cloudflare proxy (the orange cloud icon on the DNS screen), traffic is split into the following two segments.
- Visitor → Cloudflare: The browser verifies the certificate presented by Cloudflare (the edge certificate)
- Cloudflare → origin server: Cloudflare verifies the certificate installed on your server (the origin certificate)
Many of the "I automated the certificate with Cloudflare but still got an expiry warning" questions come from mixing up these two certificates. First work out which certificate you are dealing with.
Edge certificate: automated by Universal SSL
For a host name with the proxy enabled, Cloudflare automatically issues a free Universal SSL certificate and renews it automatically before it expires. You do not need to do any renewal work yourself. Cloudflare chooses the issuing certificate authority (CA) and uses several authorities interchangeably.
The following points are where people tend to get stuck.
- CAA records: If you have set CAA records on your domain to allow only specific certificate authorities, issuance and renewal fail unless the authorities Cloudflare uses are allowed. Cloudflare has a mechanism that adds the necessary CAA records, but if you have restricted them strictly by hand, check that the edge certificate status in the dashboard is Active.
- Covered host names: Universal SSL normally covers the root domain and first-level subdomains (
*.example.com). Deeper levels such asa.b.example.comare not covered and may require a separate paid feature. - Host names with the proxy turned off: A host name set to the gray cloud (DNS only) does not use Cloudflare's certificate. Because visitors reach your server directly, the origin certificate must be one that browsers trust.
Feature names and the split between features and paid plans can change, so check Cloudflare's official documentation for the details (as of October 2026).
Set the SSL/TLS encryption mode to “Full (strict)”
Before you automate the origin certificate, check the encryption mode.
- Flexible: Cloudflare → origin is not encrypted. In WordPress, the site URL is https but the request reaches the server as http, which can also cause a redirect loop
- Full: Encrypts to the origin as well, but does not verify the validity of the certificate
- Full (strict): Verifies that the origin certificate is within its validity period, matches the host name, and comes from a trusted issuer
The goal of automation is to prevent things from stopping because an expiry went unnoticed, so assume Full (strict), which performs verification. When the origin certificate is invalid in Full (strict), visitors see Cloudflare error 526 (invalid SSL certificate). Cloudflare also offers a feature that chooses the mode automatically, but check in the dashboard which mode has been selected.
Origin method 1: Cloudflare Origin CA certificate
This is an origin certificate you can issue in the Cloudflare dashboard. You can choose a long validity period (up to 15 years), so renewal work almost disappears.
- Pros: Easy to issue, and it needs renewing very rarely
- Cons: Only Cloudflare trusts this certificate; browsers do not. If you temporarily turn off the proxy, visitors will see a certificate error
The private key created at issuance is shown only on that screen. After saving it, restrict its permissions on the server (for example chmod 600) and keep it out of repositories such as Git. Specifying it in Nginx is the same as for a normal certificate.
ssl_certificate /etc/ssl/cloudflare/origin.pem;
ssl_certificate_key /etc/ssl/cloudflare/origin.key;Even if you choose a long validity period, record the expiry date somewhere. A renewal task years away tends to be forgotten when the person in charge changes.
Origin method 2: Renew Let’s Encrypt automatically with DNS validation
If you might turn the proxy off, or you want a certificate on the origin that browsers also trust, use Let's Encrypt. HTTP validation can sometimes pass through Cloudflare too, but it depends on redirect, cache and WAF settings, so DNS-01 validation, which writes a TXT record to Cloudflare's DNS, is more stable. Wildcard certificates can only be obtained with DNS-01.
Prepare an API token
In the Cloudflare dashboard, create an API token limited to the target zone that allows only DNS editing. Do not use the Global API Key, which can operate on the whole account. Write the token to a credentials file and make sure no one but the owner can read it.
# /root/.secrets/certbot/cloudflare.ini
dns_cloudflare_api_token = your-api-tokensudo chmod 600 /root/.secrets/certbot/cloudflare.iniInstall certbot and the plugin, then obtain the certificate
If you installed certbot with snap, add the DNS plugin with snap as well (package names and steps differ by OS and distribution method, so check certbot's official instructions).
sudo snap set certbot trust-plugin-with-root=ok
sudo snap install certbot-dns-cloudflare
sudo certbot certonly \
--dns-cloudflare \
--dns-cloudflare-credentials /root/.secrets/certbot/cloudflare.ini \
--dns-cloudflare-propagation-seconds 60 \
-d example.com -d '*.example.com' \
--deploy-hook "systemctl reload nginx"--deploy-hook runs only when renewal succeeds, so put the command that makes the web server load the new certificate there. Without it, you end up with the file renewed but the old certificate still being served.
Check automatic renewal
The snap version of certbot registers a renewal timer automatically. Check that it is registered and that renewal actually works.
systemctl list-timers | grep certbot
sudo certbot renew --dry-runIf --dry-run succeeds, the real renewal will follow the same steps.
What to check when renewal stops
First, separate which certificate has the problem.
# Certificate the visitor sees (edge)
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -issuer -enddate
# Origin certificate (connect directly to the server, bypassing Cloudflare)
echo | openssl s_client -connect 203.0.113.10:443 -servername example.com 2>/dev/null \
| openssl x509 -noout -issuer -enddateReplace 203.0.113.10 with the IP address of your origin server. Check in the following order, from the most likely cause.
- The web server was not reloaded after renewal: This is when the file's expiry is new but the certificate being served is old. Check
--deploy-hook - API token permissions or expiry: If you deleted and recreated the token, or the target zone is wrong,
--dry-runfails with an authentication error. Details are in/var/log/letsencrypt/letsencrypt.log - DNS propagation wait is too short: If validation starts before the TXT record is visible, it fails. Increase
--dns-cloudflare-propagation-seconds - CAA records: Issuance fails if Let's Encrypt is not allowed
Let's Encrypt ended its expiry notification emails in 2025, so you need to set up your own way of being told about expiry. Either run the openssl commands above regularly and look at the remaining days, or use an external monitoring service.
Summary
- A certificate through Cloudflare comes in two parts, edge and origin, and you think about automating them separately
- The edge certificate is issued and renewed automatically by Universal SSL. Watch the CAA records and the covered host names
- Set the encryption mode to Full (strict) and make sure you can notice when the origin certificate expires
- For the origin, use Origin CA if a Cloudflare-only certificate is fine, or Let's Encrypt DNS-01 (with a minimum-privilege API token) if browsers should trust it as well
- Count reloading after renewal and expiry monitoring as part of the automation
Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)