# Cloudflare vs Lets encrypt **URL:** \ **Category:** Help\ **Created:** [February 27, 2018, 6:28am UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218 "2018-02-27T06:28:15Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![cadamooz](https://avatars.discourse-cdn.com/v4/letter/c/ad7895/32.png) [@cadamooz](https://community.letsencrypt.org/u/cadamooz)\ **Post date:** [February 27, 2018, 6:28am UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/1 "2018-02-27T06:28:15Z")
Hi My host provided me with free Lets encrypt SSL. But I use cloudflare. It seems that these two do not work together. The host provider said this to me. I want to sure that they were true. thanks My domain is: www.cadamooz.ir ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [February 27, 2018, 6:44am UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/2 "2018-02-27T06:44:46Z")
In one respect, it is true. If you use Cloudflare’s CDN/proxy services, then the certificate presented to the end-user when visiting your website will be the one issued by Cloudflare, not Let’s Encrypt. However, Cloudflare doesn’t prevent you from issuing Let’s Encrypt certificates nor protecting your origin server with a Let’s Encrypt certificate. It is largely an apples vs oranges comparison. Cloudflare is a CDN/reverse proxy that features automatic SSL. Let’s Encrypt is a certificate authority. ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [February 27, 2018, 7:40am UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/3 "2018-02-27T07:40:18Z")
> [@\_az](#): > > However, Cloudflare doesn’t prevent you from issuing Let’s Encrypt certificates nor protecting your origin server with a Let’s Encrypt certificate. The hosting provider might also have meant that some methods of _obtaining_ a Let's Encrypt certificate don't work if your server is already behind CloudFlare. This is true, but other methods do work. It's not impossible in principle. However, a particular hosting provider might have implemented its hosting in a way where that provider would not currently be able to obtain new Let's Encrypt certificates for customers who have put their services behind CloudFlare's reverse proxy. Everything that @_az said is right: if you use CloudFlare, visitors to your site won't _see_ your Let's Encrypt certificate, even if you do have one. You could use Let's Encrypt to protect (only) the connection between CloudFlare and your web server, which is potentially valuable, but people visiting your site won't know that you're doing this. CloudFlare also provides an alternative called the CloudFlare origin CA, where CloudFlare users can obtain a free certificate from CloudFlare itself to protect the connection between CloudFlare and the origin server. This is a very reasonable alternative to Let's Encrypt if you intend to use CloudFlare over the long term. Since only CloudFlare would be connecting directly to your site, that part of the connection would not need to be authenticated by a publicly-trusted certificate authority like Let's Encrypt. ---
**Author:** ![cadamooz](https://avatars.discourse-cdn.com/v4/letter/c/ad7895/32.png) [@cadamooz](https://community.letsencrypt.org/u/cadamooz)\ **Post date:** [February 27, 2018, 8:02am UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/4 "2018-02-27T08:02:55Z")
Thanks. @schoen put it well: “However, a particular hosting provider might have implemented its hosting in a way where that provider would not currently be able to obtain new Let’s Encrypt certificates for customers who have put their services behind CloudFlare’s reverse proxy” I think this is the problem with my host provider. As you said, I think it is better for me to have a Free cloudflare certificate and forget the lets encrypt. Am I right? ---
**Author:** ![gotham](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gotham/32/16320_2.png) [@gotham](https://community.letsencrypt.org/u/gotham)\ **Post date:** [February 27, 2018, 9:39am UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/5 "2018-02-27T09:39:08Z")
i am using Letsencrypt ssl with cloudflare . i am not facing any issues . Just make sure Inside cloudflare --\> crypto --\> ssl --\> full enabled .If its fine everything will work fine . ---
**Author:** ![cadamooz](https://avatars.discourse-cdn.com/v4/letter/c/ad7895/32.png) [@cadamooz](https://community.letsencrypt.org/u/cadamooz)\ **Post date:** [February 27, 2018, 10:40am UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/6 "2018-02-27T10:40:57Z")
thanks. I check there, the option is grayed out. I cant change it. it says Status: Ineligible for SSL ![2018-02-27_14-10-16](https://global.discourse-cdn.com/letsencrypt/original/3X/c/8/c8acd732f9e6b2b92f796200e869f0da8845bb50.jpg) ---
**Author:** ![gotham](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gotham/32/16320_2.png) [@gotham](https://community.letsencrypt.org/u/gotham)\ **Post date:** [February 27, 2018, 10:45am UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/7 "2018-02-27T10:45:13Z")
The problem is with your domain name .www.cadamooz.ir Please talk to cloudflare. Or pause the site and apply letsencrypt ssl and enable it . ---
**Author:** ![cadamooz](https://avatars.discourse-cdn.com/v4/letter/c/ad7895/32.png) [@cadamooz](https://community.letsencrypt.org/u/cadamooz)\ **Post date:** [February 27, 2018, 10:47am UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/8 "2018-02-27T10:47:11Z")
What do you mean? what is wrong with my domain? ---
**Author:** ![gotham](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gotham/32/16320_2.png) [@gotham](https://community.letsencrypt.org/u/gotham)\ **Post date:** [February 27, 2018, 10:47am UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/9 "2018-02-27T10:47:48Z")
> **[Support .IR in SSL](https://community.cloudflare.com/t/support-ir-in-ssl/1912/3)** > > Cloudflare does not hate you. But due to US Export Regulation, Cloudflare’s SSL vendor Comodo cannot issue a certificate to several ccTLDs. Unfortunately .IR is one. A full list can be seen in this link: ... Its not working for iran domains. Update : Please check orange cloud is enabled for your domain . If its enabled and ssl is ineligible.Its domain issue for the country iran. ---
**Author:** ![cadamooz](https://avatars.discourse-cdn.com/v4/letter/c/ad7895/32.png) [@cadamooz](https://community.letsencrypt.org/u/cadamooz)\ **Post date:** [February 27, 2018, 10:49am UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/10 "2018-02-27T10:49:01Z")
Aha. Thanks. so what should I do? should I change my DNS in cpanel and delet cloudflare dns? ---
**Author:** ![gotham](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gotham/32/16320_2.png) [@gotham](https://community.letsencrypt.org/u/gotham)\ **Post date:** [February 27, 2018, 10:51am UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/11 "2018-02-27T10:51:08Z")
I recommend "Talk to support once" for this issue . But the hack is > [@gotham](#): > > pause the site and apply letsencrypt ssl and enable it . Note: Site will load directly from server. Not via cloudflare. ---
**Author:** ![gotham](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gotham/32/16320_2.png) [@gotham](https://community.letsencrypt.org/u/gotham)\ **Post date:** [February 27, 2018, 10:53am UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/12 "2018-02-27T10:53:56Z")
> [@cadamooz](#): > > It seems that these two do not work together. The host provider said this to me. I want to sure that they were true. Your hosting provider said it right . Cloudflare wont support iran domains. ---
**Author:** ![cadamooz](https://avatars.discourse-cdn.com/v4/letter/c/ad7895/32.png) [@cadamooz](https://community.letsencrypt.org/u/cadamooz)\ **Post date:** [February 27, 2018, 10:55am UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/13 "2018-02-27T10:55:04Z")
recently I asked someone to speedup my site, and they changed some of wordpress options and files and added few plugins. They also create cloudflare account. I dont know what would happen, if I remove cloudflare DNS from cpanel. ---
**Author:** ![gotham](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/gotham/32/16320_2.png) [@gotham](https://community.letsencrypt.org/u/gotham)\ **Post date:** [February 27, 2018, 10:57am UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/14 "2018-02-27T10:57:22Z")
There are many CDN providers in the world. Dont always rely on one . Ex: Akamai Amazon cloudfront Sucuri Before purchasing kindly ask them if they support iran domains. So go for it . Good luck ---
**Author:** ![bytecamp](https://avatars.discourse-cdn.com/v4/letter/b/54ee81/32.png) [@bytecamp](https://community.letsencrypt.org/u/bytecamp)\ **Post date:** [February 27, 2018, 12:01pm UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/15 "2018-02-27T12:01:59Z")
> [@gotham](#): > > There are many CDN providers in the world. Dont always rely on one . Assuming that this site needs a CDN at all. ---
**Author:** ![cadamooz](https://avatars.discourse-cdn.com/v4/letter/c/ad7895/32.png) [@cadamooz](https://community.letsencrypt.org/u/cadamooz)\ **Post date:** [February 27, 2018, 12:24pm UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/17 "2018-02-27T12:24:43Z")
> [@cadamooz](#): > > how should I know that my site needs one or not how should I know that my site needs one or not ---
**Author:** ![jansch](https://avatars.discourse-cdn.com/v4/letter/j/f0a364/32.png) [@jansch](https://community.letsencrypt.org/u/jansch)\ **Post date:** [February 27, 2018, 2:34pm UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/18 "2018-02-27T14:34:12Z")
Cloudflare is basically a webhoster on top of your webhoster. Therefore, it includes some security and load balancing features. You should want it, if - You think, that many (like A LOT) of people are visiting your site at the same time - You want your html-files to be cached and sent to the “customer” faster (5ms response time instead of 50ms for example) - You fear that someone wants to harm you and DDos your website (put your website down) - …some more use cases to add if you like ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [February 27, 2018, 10:25pm UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/19 "2018-02-27T22:25:30Z")
> [@cadamooz](#): > > I think this is the problem with my host provider. As you said, I think it is better for me to have a Free cloudflare certificate and forget the lets encrypt. This is probably true for most people, but unfortunately the rest of this thread shows a policy problem with CloudFlare obtaining certificates issuing for Iranian domains. Let's Encrypt _does_ allow certificates for Iranian domains (other than governmental domains), but by itself that can't solve the problem described by other people in this thread, because CloudFlare's current configuration uses a different certificate authority to obtain the certificates that it presents to the public, regardless of which certificate authority is used by your back-end ("origin") server. A CDN like CloudFlare is likely to make your site faster for most users worldwide and also defend against many denial of service attacks where people try to make a site unavailable by overwhelming it with too much traffic. However, some CDNs based in the U.S. seem to limit the services that they provide for Iranian users, so I guess you'll have to research this when choosing it. I've previously communicated to CloudFlare that Let's Encrypt would be happy to issue free certificates _for CloudFlare to present to the public_ for all of the company's Iranian users, but so far CloudFlare hasn't taken advantage of this option (and maybe faces engineering challenges in doing so). I'll be happy to remind them about this, but I wouldn't expect any results quickly. ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [February 27, 2018, 10:32pm UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/20 "2018-02-27T22:32:40Z")
It may be worth contacting Cloudflare? The last post in the thread linked above was optimistic. > **[Support .IR in SSL](https://community.cloudflare.com/t/support-ir-in-ssl/1912/4?u=mnordhoff)** > > @khosroanjam, We definitely did not exclude that domain with intent, rather it was a limitation of the partner as others have stated. However we’re always looking to expand our offerings and provide redundancy. By the end of the month I believe you... They use multiple CAs, at least one of which isn’t American, but I don’t know what their policies are. ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [February 27, 2018, 10:33pm UTC](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218/21 "2018-02-27T22:33:10Z")
@mnordhoff, thanks for checking the thread—that sounds like potentially good news! [Next page](https://community.letsencrypt.org/t/cloudflare-vs-lets-encrypt/54218.md?page=2)