Skip to content

Commit 7a1a3c0

Browse files
Add origin server errors and list necessary root CA files
1 parent 47163e5 commit 7a1a3c0

File tree

1 file changed

+23
-2
lines changed

1 file changed

+23
-2
lines changed

src/content/docs/ssl/origin-configuration/origin-ca/troubleshooting.mdx

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,30 @@ Consider the following common issues and troubleshooting steps when using [Cloud
1616
### Cause
1717
<Render file="origin-ca-pause-error" />
1818

19-
This also means that SSL Labs or any other SSL validator are also expected to flag the certificate as invalid.
19+
This also means that SSL Labs or similar SSL validators are expected to flag the certificate as invalid.
2020

2121
### Solutions
2222

2323
- Make sure the [proxy status](/dns/manage-dns-records/reference/proxied-dns-records/) of your DNS records and any [page rules](/rules/page-rules/) (if existing) are set up correctly. If so, you can try turning proxy off and then on again and wait a few minutes.
24-
- If you must have direct connections between clients and your origin server, consider installing a publicly trusted certificate at your origin instead. This process is done outside of Cloudflare, where you should issue the certificate directly from a <GlossaryTooltip term="Certificate Authority (CA)">certificate authority (CA)</GlossaryTooltip> of your choice. You can still use Full (strict) [encryption mode](/ssl/origin-configuration/ssl-modes/), as long as the CA is listed on the [Cloudflare trust store](https://github.com/cloudflare/cfssl_trust).
24+
- If you must have direct connections between clients and your origin server, consider installing a publicly trusted certificate at your origin instead. This process is done outside of Cloudflare, where you should issue the certificate directly from a <GlossaryTooltip term="Certificate Authority (CA)">certificate authority (CA)</GlossaryTooltip> of your choice. You can still use Full (strict) [encryption mode](/ssl/origin-configuration/ssl-modes/), as long as the CA is listed on the [Cloudflare trust store](https://github.com/cloudflare/cfssl_trust).
25+
26+
## The issuer of this certificate could not be found
27+
28+
### Cause
29+
Some origin web servers require that you upload the Cloudflare origin CA root certificate or certificate chain.
30+
31+
### Solution
32+
Use the following links to download either an ECC or an RSA version and upload to your origin web server:
33+
34+
* [Cloudflare Origin ECC PEM](/ssl/static/origin_ca_ecc_root.pem) (do not use with Apache cPanel)
35+
* [Cloudflare Origin RSA PEM](/ssl/static/origin_ca_rsa_root.pem)
36+
37+
## The certificate is not trusted in all web browsers
38+
39+
### Cause
40+
Apache cPanel requires that you upload the Cloudflare origin CA root certificate or certificate chain.
41+
42+
### Solution
43+
Use the following link to download an RSA version of the root certificate and upload it to your origin web server:
44+
45+
* [Cloudflare Origin RSA PEM](/ssl/static/origin_ca_rsa_root.pem)

0 commit comments

Comments
 (0)