AutoSSL behind Cloudflare: why the free certificate leaves names out or fails to renew

Speed, Cache & CDN·· 10 views· 4 min read

The short answer: the server’s free certificate (cPanel’s AutoSSL) is still needed with Cloudflare in front: it protects the leg between Cloudflare and the server in Full (strict) mode, and it protects mail, which does not go through Cloudflare. To issue it, the server has to prove each name is yours and reaches it. With DNS on Cloudflare, the zone that counts is no longer the server’s, so the proof goes over the web. When a name is left out, it is because it does not exist in Cloudflare’s DNS, points somewhere else, a CAA record does not authorise issuance, or something answers in the server’s place.

Why a name is left out, or will not renew

Cause How to recognise it What to do
The name does not exist in Cloudflare’s DNS (mail, webmail, cpanel, autodiscover) SSL/TLS Status shows it excluded or with a failed check; Outlook warns about the certificate on mail.yourdomain. Create the record at Cloudflare, grey, pointing at the server, and run AutoSSL again.
The name points somewhere else The record at Cloudflare holds an old address or another service’s. Fix the value. The server only certifies names that reach it.
A CAA record does not authorise the authority the server uses There are CAA records at Cloudflare and none authorises that authority. Add it: CAA records.
A protection answers in the server’s place Attack mode, bot mode or a country rule challenges or blocks the validator, which is a bot. Let the /.well-known/acme-challenge/ path through, or turn the name grey during renewal.
The certificate has already expired and the check is sent to https In Full (strict), Cloudflare refuses to connect to a server with an expired certificate and shows error 526. Turn the name grey, run AutoSSL, turn it orange again.
A cache rule stores everything, /.well-known/ included The check gets an old answer, stored at Cloudflare. Exclude that path from the cache.

The renewal that works

1 See the status: in cPanel, open SSL/TLS Status. It shows which names are covered, which are excluded and, beside them, the reason.
2 Check the DNS at Cloudflare: every name that needs a certificate has to exist there and point at the server. Mail and admin names stay grey: orange cloud or grey cloud.
3 If you have CAA records, make sure they authorise the authority the server uses. Cloudflare may add its own authorities by itself; the server’s have to be there on their own.
4 If the failing name is orange, turn it grey for a while and give the TTL time. The check then reaches the server with nothing in between.
5 Run AutoSSL again in SSL/TLS Status and wait for it to finish.
6 Once the name shows as covered, turn it orange again and make sure the SSL mode is still Full (strict).
Do not change the SSL mode to “fix” an expired certificate. On Full the leg between Cloudflare and the server goes unverified; on Flexible it goes unencrypted and the site falls into a redirect loop. Full only as a temporary step while the certificate is issued; Flexible never: switching on SSL at Cloudflare without breaking the site.
The mail certificate is this same one. If after the move Outlook or the phone start warning about the certificate on mail.yourdomain, the mail name was almost always left out of Cloudflare’s DNS or turned orange: the certificate warning in Outlook.

AutoSSL still failing? Send us the domain and the sentence SSL/TLS Status shows next to the name.

Open a support ticket

SEE ALSO

The free SSL certificate did not renew: why AutoSSL fails and what to check

Switching on SSL at Cloudflare without breaking the site

CAA records: who may issue certificates for your domain

No padlock on your site: the causes, in order

The security certificate warning in Outlook: what it means and how to stop it

Orange cloud or grey cloud at Cloudflare: which records to proxy and which to leave DNS only

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from $5.36/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.

Related Articles

Speed, Cache & CDN 181 How to monitor your site performance in cPanel cPanel keeps a record of everything that happens on your hosting - who visited, how much traffic you used, which errors...
Speed, Cache & CDN 160 The site is slow: what actually makes a difference «The site is slow» means different things depending on who says it: the first page takes ages to appear, the admin panel...
Speed, Cache & CDN 189 Cloudflare: when it helps, how to switch it on, and the cache that fools you Cloudflare sits in front of your site: visitors reach it first, and it comes to us for what it needs. That brings three...
Speed, Cache & CDN 152 The site is slow: what to measure before you change plan «The site is slow, I think I need a bigger plan.» It is one of the messages we get most, and most of the time the bigger...
Speed, Cache & CDN 189 What a CDN is, and when it makes a difference (and when it does not) A CDN (content delivery network) is a set of machines spread around the world that keep copies of your site and hand the...
Speed, Cache & CDN 2 Is this page coming from the Cloudflare cache? Reading cf-cache-status and purging one address The short answer: every response that goes through Cloudflare carries a header, cf-cache-status, that says whether it ca...