Certificate bypassed by CloudFlare

[tomato]

I have two different servers (different IPs) enrouted to both sub-domains for the same domain. e.g. sub1.domain.com & sub2.domain.com

My operating system is Ubuntu 16.04, I can connect to that machine via SSH with root privileges and I’m using nginx 1.10.0 and certbot 0.12.0

I’m using CloudFlare as my DNS server, so I opted using the manual option for the certbot command (maybe how to use webroot under CloudFlare is another topic).
It created a challege that I stated in my TXT records, and then created the certificate environment (placed under the default letsencrypt path).

Until here everything gone good. But now I face 2 issues:

1. My nginx sites-available (enabled link) points to the old certificate, but the new one is being used by the web page.
2. The sub2 domain is using the certificate too, but there’s no letsencrypt certificate inside it.

I suspect that CloudFlare is somehow managing my server certificates through the record, but I’m not sure this is possible.

Anyway, for SSL routing for 443 inside my nginx “sites” file I have to point to a real cert file, but it is not being used at all. Also, protocols and ciphers are not being used by the server. Looks weird for me.

I ran this command to create the certificate:
sudo certbot -d sub1.domain.com --manual --preferred-challenges dns certonly

I ran this other command to check certificates on sub1.domain.com:
sudo certbot certificates

It produced this output:
[sudo] password for administrador: Saving debug log to /var/log/letsencrypt/letsencrypt.log OCSP check failed for /etc/letsencrypt/live/sub1.domain.com/cert.pem (are we offline?) Found the following certs: Certificate Name: sub1.domain.com Domains: sub1.domain.com Expiry Date: 2017-08-16 09:55:00+00:00 (VALID: 88 days) Certificate Path: /etc/letsencrypt/live/sub1.domain.com/fullchain.pem Private Key Path: /etc/letsencrypt/live/sub1.domain.com/privkey.pem
I ran this other command to check certificates on sub2.domain.com:
sudo certbot certificates

It produced this output:
[sudo] password for admin: Saving debug log to /var/log/letsencrypt/letsencrypt.log No certs found.

Thank you in advance,

[ahaw021]

Hi @tomato

Who’s certificates do users get they browse to your sites?

CloudFlare issued ones or LetsEncrypt ones

Note: certbot doesn’t replicate certifcates between servers so certificates are only probably kept on one of your two servers

Also check the following in your cloudflare:

If the cloud is lit up it means that CloudFlare proxies the requests (using their internal certs and uses LetsEncrypt in the backend connections)

You can untick it (grey cloud) and hopefully your Lets Encrypt certificates and configurations should be working

Andrei

[tomato]

Thank you @ahaw021,

It seems that, as you say, CloudFlare is proxying the requests, blocking certbot certificates.
Something must happened with CloudFlare’s account, but now it’s working.

Regards,