SSL Cloudflare HTTPS with Cloudflare Flexible SSL Certificate: is it that simple?

Hello guys,

I've been using CMM let's encrypt SSL certificate insuance for the past few years without any issue, I was using Cloudflare just for their DNS service.

Now I would like to use Cloudflare Flexible SSL certificate.

---

Can someone confirm that what I'm doing is correct? I'm a bit surprised that it is that simple:

1) Create nginx vhost with CMM menu 2 or 22

2) During vhost creation, don't select any option to create a self-signed or let's encrypt certificate

3) In Cloudflare just select the Flexible SSL option and redirect everything to https option

Could it be that simple or am I missing an important point?

Thanks a lot!

 

Hello guys,

Since Eva recommended using Full I tried to set it up. It was really not that easy so here is the summary of the steps I used:

NB: this is using cloudflare Full (not strict) mode and cloudflare API

0) the vhost for the domain you want to add to your CMM server doesn't exist yet

1) create CF API token as described here: Letsencrypt Free SSL Certificates and add the necessary token and account ID in the /etc/centminmod/custom_config.inc file

IMPORTANT: I could not make it work if I entered a "Client IP Address Filtering", not exactly sure why but it's probably not such a deal to not restrict to a single IP.

2) the /etc/centminmod/custom_config.inc should also have LETSENCRYPT_DETECT='y'

3) in CF > DNS > Records, the domain you want to configure should have 2 A records (@ and www) pointing to your server with cloudflare PROXY enabled (orange cloud icon with an arrow going through it)

4) in CF > SSL/TLS > Overview, the mode should be "Full - Encrypts end-to-end, using a self signed certificate on the server"

5) in CF > SSL/TLS > Edge Certificates > Always use HTTPS should be DISABLED (cloudflare keeps on moving this "Always use HTTPS" option all the time so look around if not under this submenu...)

6) run centmin

7) choose option 2 (or 22 if wordpress) and confirm you want to continue with vhost creation

8) enter the domain and confirm you want to continue then I used:
Create a self-signed SSL certificate Nginx vhost? [y/n]: n
Get Letsencrypt SSL certificate Nginx vhost? [y/n]: y

and confirm continue

Then you'll get many rows (I got 4x2) indicating all IPv4 adresses as well as "behind cloudflare IPs" lists for ipV4 and ipV6

9) Confirm you want to continue,

and then I chose:
4. issue live cert with HTTPS default (trusted)

10) create FTP user as you want

11) if it succeeds you should have some letsdebug success messages. When I tried with a token with IP address filtering that's where I got some errors like 'invalid domain' somewhere

12) Exit centmin, then go to vhost folder: cd /usr/local/nginx/conf/conf.d && ls and edit your vhost file

13) uncomment the line here to get real IP:
#include /usr/local/nginx/conf/cloudflare.conf;

Sidenote: this PHP script here from stackoverflow allow you to get the real IP without having to uncomment the line above, I use it for every custom script so I know it'll work even if I screwed up and forgot to uncomment the line...

PHP:

<?PHP

function getUserIP()
{
    // Get real visitor IP behind CloudFlare network
    if (isset($_SERVER["HTTP_CF_CONNECTING_IP"])) {
              $_SERVER['REMOTE_ADDR'] = $_SERVER["HTTP_CF_CONNECTING_IP"];
              $_SERVER['HTTP_CLIENT_IP'] = $_SERVER["HTTP_CF_CONNECTING_IP"];
    }
    $client  = @$_SERVER['HTTP_CLIENT_IP'];
    $forward = @$_SERVER['HTTP_X_FORWARDED_FOR'];
    $remote  = $_SERVER['REMOTE_ADDR'];

    if(filter_var($client, FILTER_VALIDATE_IP))
    {
        $ip = $client;
    }
    elseif(filter_var($forward, FILTER_VALIDATE_IP))
    {
        $ip = $forward;
    }
    else
    {
        $ip = $remote;
    }

    return $ip;
}


$user_ip = getUserIP();

echo $user_ip; // Output IP address [Ex: 177.87.193.134]


?>

14) restart nginx

should be all good now, maybe just run a check on https://www.sslshopper.com/ssl-checker.html