# Cloudflare + LetsEncrypt **URL:** \ **Category:** Help\ **Created:** [October 3, 2019, 12:32pm UTC](https://community.letsencrypt.org/t/cloudflare-letsencrypt/103361 "2019-10-03T12:32:09Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![jpbcx43](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@jpbcx43](https://community.letsencrypt.org/u/jpbcx43)\ **Post date:** [October 3, 2019, 12:32pm UTC](https://community.letsencrypt.org/t/cloudflare-letsencrypt/103361/1 "2019-10-03T12:32:09Z")
Hello. I’m using TurnkeyLinux with the dehydrated wrapper - everything works great to generate multiple LetsEncrypt certificates. I recently integrated Cloudflare, which works great with Universal SSL. The site in question is [https://aninaphoto.com](https://aninaphoto.com) I’d like to continue using the LetsEncrypt certificate rather than Cloudflare’s Universal SSL and their cert, however I receive the following errors after disabling Universal SSL: SSL\_ERROR\_NO\_CYPHER\_OVERLAP (Firefox) ERR\_SSL\_VERSION\_OR\_CIPHER\_MISMATCH (Chrome) I’ve enabled the following ciphers on my Apache server: SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 I know that there are sites proxied through Cloudflare that are using their own LetsEncrypt certs, so there is something I am missing. Perhaps it has something to do with the origin pull configuration? I’ve tried this config on both Full and Full (Strict) configs. Do you have a recommended cipher config? My site receives an A+ at ssllabs. If I disable the Cloudflare proxy, my site displays just fine with no issues. I can even re-enable Universal SSL and the handshake completes. ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [October 3, 2019, 12:38pm UTC](https://community.letsencrypt.org/t/cloudflare-letsencrypt/103361/2 "2019-10-03T12:38:21Z")
Cloudflare only allows you to upload custom certificates on the Business and Enterprise plans. > **[Our Plans | Pricing](https://www.cloudflare.com/plans/)** > > Discover which Cloudflare plan is correct for your requirements. Find out more about Cloudflare plan pricing and sign up for Cloudflare here! > [@jpbcx43](#): > > I know that there are sites proxied through Cloudflare that are using their own LetsEncrypt certs, so there is something I am missing. Can you provide an example of one? ---
**Author:** ![jpbcx43](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@jpbcx43](https://community.letsencrypt.org/u/jpbcx43)\ **Post date:** [October 3, 2019, 12:44pm UTC](https://community.letsencrypt.org/t/cloudflare-letsencrypt/103361/3 "2019-10-03T12:44:49Z")
I understand - I am not trying to upload custom certificates. I am trying to pass proxied traffic through to my LetsEncrypt that’s hosted on my own server. cloudflare has this option available: “Full (Strict) Encrypts end-to-end, but requires a trusted CA or Cloudflare Origin CA certificate on the server” Yes - an example of one is: [https://www.lakesregion.org/](https://www.lakesregion.org/) You can see he’s being proxied through Cloudflare, however he’s using his own cert. I suppose I could message him to see how Cloudflare support got it working, I saw his post on the Cloudflare forums. I was just curious to know if anyone from the community knows the recommended ciphers to be using. ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [October 3, 2019, 12:53pm UTC](https://community.letsencrypt.org/t/cloudflare-letsencrypt/103361/4 "2019-10-03T12:53:19Z")
The certificate on your origin, and the certificate on Cloudflare's proxy servers, are not necessarily related. "Universal SSL" -- or a custom certificate -- are about the certificate on Cloudflare's proxy servers. If you turn off Universal SSL, and don't have another certificate available, Cloudflare's proxy service can't support HTTPS. If you leave Universal SSL enabled, set "Full (strict)", and use the Let's Encrypt certificate on your origin, the Let's Encrypt certificate will be used to secure the connection between your origin and Cloudflare, and the Universal SSL certificate will be used to secure the connection between Cloudflare and visitors. > [@jpbcx43](#): > > Yes - an example of one is: [https://www.lakesregion.org/](https://www.lakesregion.org/) For me, that site isn't using Cloudflare. I get a Google Cloud IP address. ---
**Author:** ![jpbcx43](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@jpbcx43](https://community.letsencrypt.org/u/jpbcx43)\ **Post date:** [October 3, 2019, 12:55pm UTC](https://community.letsencrypt.org/t/cloudflare-letsencrypt/103361/5 "2019-10-03T12:55:25Z")
Understood. I am at a loss as far as why I get these browser messages after disabling Universal SSL - I clearly have a working cert. Thanks for your input. ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [October 3, 2019, 1:06pm UTC](https://community.letsencrypt.org/t/cloudflare-letsencrypt/103361/6 "2019-10-03T13:06:51Z")
If you disable Universal SSL, then Cloudflare’s proxy servers do not have any cert at all, regardless of what’s on your origin. ---
**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\ **Post date:** [October 3, 2019, 1:32pm UTC](https://community.letsencrypt.org/t/cloudflare-letsencrypt/103361/7 "2019-10-03T13:32:11Z")
cloudflare has this option available: “Full (Strict) Encrypts end-to-end, but requires a trusted CA or **Cloudflare Origin CA certificate** on the server” do you aware of Cloudflare origin CA? > **[CloudFlare Origin CA](https://blog.cloudflare.com/cloudflare-ca-encryption-origin/)** > > In the fall of 2014 CloudFlare launched Universal SSL and doubled the number of sites on the Internet accessible via HTTPS. In just a few days we issued certificates protecting millions of our customers’ domains and became the easiest way to secure... ---
**Author:** ![jpbcx43](https://avatars.discourse-cdn.com/v4/letter/j/ecccb3/32.png) [@jpbcx43](https://community.letsencrypt.org/u/jpbcx43)\ **Post date:** [October 3, 2019, 1:39pm UTC](https://community.letsencrypt.org/t/cloudflare-letsencrypt/103361/8 "2019-10-03T13:39:31Z")
Yes - I tried installing that in my apache config - but it did not work. I shouldn’t need one as my sites are already secured with LetsEncrypt. I will probably just use the Cloudflare SSL, as it seems to work fine. SSLVerifyClient require SSLVerifyDepth 1 SSLCACertificateFile /etc/ssl/certs/origin-pull-ca.pem ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [November 2, 2019, 1:39pm UTC](https://community.letsencrypt.org/t/cloudflare-letsencrypt/103361/9 "2019-11-02T13:39:44Z")
Closed on November 2, 2019, 1:39pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.