How to Get a SSL Certificate from Cloudflare and Install It on Your Server

---

Step 1: Generate SSL Certificate in Cloudflare

1. Log into Cloudflare → Go to SSL/TLS → Click on "Origin Server".
2. Click "Create Certificate".
3. Choose "Let Cloudflare generate a private key and a CSR".
4. Under Key Format, select PEM (recommended).
5. Add your domain (subdomain.example.com) and optionally *.subdomain.example.com (wildcard).
6. Choose 15 years validity.
7. Click "Create".

---

Step 2: Download & Save the Certificate

After generation, Cloudflare will provide:

• Origin Certificate → Copy and save as /etc/ssl/certs/cloudflare_origin.pem
• Private Key → Copy and save as /etc/ssl/private/cloudflare_origin.key

Run:

sudo nano /etc/ssl/certs/cloudflare_origin.pem

Paste the Origin Certificate, then save.

sudo nano /etc/ssl/private/cloudflare_origin.key

Paste the Private Key, then save.

Set proper permissions:

sudo chmod 644 /etc/ssl/certs/cloudflare_origin.pem
sudo chmod 600 /etc/ssl/private/cloudflare_origin.key

---

Step 3: Configure Nginx to Use Cloudflare SSL

Edit your Nginx site configuration:

sudo nano /etc/nginx/sites-available/subdomain.example.com

Modify it to use the Cloudflare certificate:

server {
    listen 443 ssl;
    server_name subdomain.example.com;

    ssl_certificate /etc/ssl/certs/cloudflare_origin.pem;
    ssl_certificate_key /etc/ssl/private/cloudflare_origin.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location / {
        root /var/www/subdomain.example.com/htdocs;
        index index.html;
    }
}

Test and reload Nginx:

sudo nginx -t
sudo systemctl restart nginx

---

Step 4: Set SSL Mode in Cloudflare

1. Go to Cloudflare Dashboard → SSL/TLS.
2. Set SSL mode to Full (Strict).

---

Step 5: Verify SSL Installation

Check SSL status:

openssl s_client -connect subdomain.example.com:443

or visit:

https://subdomain.example.com

---

Cloudflare SSL vs Let's Encrypt

Feature	Cloudflare SSL (Origin)	Let's Encrypt
Validity	Up to 15 years	90 days
Renewal	Manual	Auto (via acme.sh)
Security	Strong (if Full Strict)	Strong
Works with Cloudflare Proxy?	✅ Yes	⚠ May need extra steps

---

Done! Your site is now using Cloudflare SSL 🚀

Let me know if you hit any issues!