2.9.1.4. Installing SSL from Cloudflare

To properly configure an SSL certificate using Cloudflare, you need:

1. Configure a domain on the Cloudflare side.
2. Tune work of an SSL certificate within Cloudflare and write out a certificate for hosting.
3. Install, obtained in the second paragraph, the certificate on the hosting.

To set up a certificate on the Cloudflare side and then create a certificate for hosting, you need:

1. Signin to your Cloudflare account.
2. Go to the section "SSL/TLS»:
3. In section "Overview"Select the appropriate principle of the certificate (it is recommended to select"Full (strict)", The process of its configuration will be described later):
   • «Flexible»- data is encrypted only between the client and Cloudflare. In this case, the installation of a certificate for the hosting is not required, but you need to disable all methods of redirecting the site to HTTPS within the hosting and site. (Not recommended.)
   • «Full»- data is encrypted both between the client and Cloudflare, and between Cloudflare and the hosting. On the hosting side, you can install self-signed certificate... This method may be less secure than the next one due to the lack of certificate validation on the hosting side. (Not recommended.)
   • «Full (strict)»- data is encrypted both between the client and Cloudflare, and between Cloudflare and the hosting. The difference between this method and the previous one is that on the Cloudflare side, you will need to write your own certificate for hosting, which will be checked for validity in the future, and installed, which will be more secure, unlike other methods. (Recommended method.)
4. After choosing how encryption works, go to the section "Origin server" and press "Create Certificate»:
5. Specify the data for creating a certificate:
   1. Select "Let Cloudflare generate a private key and a CSR"(Creating a CSR request from Cloudflare).
   2. Specify the required domains and subdomains to be included in the certificate.
   3. Select a certificate expiration date.
   4. Click "Next».
6. Do not close the window that opens before completing all the actions. Opposite "Key format»Select«PEM (Default)”, Then copy the following certificate and key into different files (file extension can be any).
7. Install the certificate on the hosting using the generated files.