Cloudflare Proxy as Certbot replacement for website on Debian server?
I have a Debian server and have linked it to my domain and created a WordPress website on it. I have this domain in Cloudflare, and the corresponding DNS entry is proxy-enabled. Although no SSL certificate was installed on the server, my browser shows a secure connection with a valid certificate. However, when I navigate to /wp-admin, it usually shows a secure connection, but sometimes it changes to insecure.
Is Cloudflare's proxy sufficient as a replacement for an SSL certificate, or should I install Certbot for an SSL certificate?
(2 votes)
Loading...
No, that’s not enough. With your configuration, the connection from the client to cloudflare is secured via their certificate, but not the connection from cloudflare to your server.
Cloudflare provides free certificates for Origin server available that you can install there. They are valid for a long time (I believe 15 years) and therefore need not be renewed (often).
Then place the communication Total or strict and then it should fit. Then activate HTTPS in WordPress.
So should I rather use the free certificates of Cloudflare and not Certbot with automatic renewal of Let’s encrypt certificates?
Remember to set up the rule for the subdomain in the CF dashboard
If I go to the SSL/TLS menu from the domain in Cloudlfare, the following is available:
SSL/TLS encryption
Current encryption mode:
Flexible
The encryption mode was last changed 17 days ago.
Next automatic scan on: 11/20.
domain.de uses automatic SSL/TLS
Your encryption mode is set to the recommendation of Cloudflare. You can overwrite this by switching to “user-defined”.
And with Flexible Cloudflare writes:
As already said, this is not safe because all traffic between Cloudflare and your server is unencrypted.
Section Origin server you can have a certificate for your server and download it. If you have installed this, you can add the encryption to Fully and are on the safe side.
Thanks, that worked, I didn’t think about it.
Then I don’t know what WordPress wants. Did you also set the URLs to https in WordPress under Settings → Generally?
Yes, I did
And as I have already written, you also have the setting for the SSL/TLS encryption mode in Cloudflare Flexible on Fully changed?
I have everything like in this tutorial (https://www.orchidbox.com/insights/how-to-install-a-cloudflare-origin-certificate-on-your-apache-server/) made to redirect in cloudflare always to HTTPS, for always HTTPS use the WordPress Config and the .htaccess file adapted and restarted the server, but in WordPress I am still displayed in the website state that the website does not use HTTPS.
As long as you secure the traffic between Cloudflare and your server with an internal cert, this is enough. But can use it as well as certbot.
When the traffic is clarified by cloudflare (not only DNA is running over cloudflare!) it has a valid certificate of cloudflare to the outside.