SSL Cloudflare SSL questions..

For SSL, it works but I have some questions which I can't really find a definite answer after searching on the net and reading the CentminMOD docs and posts.

I'm using free Cloudflare proxied DNS (orange cloud) and vurtr CENTOS 7.

I roughly list the follow things (not really a complete list) I've done in case some people are interested.

1) I installed the SSL vhost in centmin menu 2.

2) I got http forwarded to https by the setting in Cloudflare and also uncommented the following line in the myserver.ssl.conf (I renamed myserver.conf to myserver.conf-disabled):

Code (Text):

 server {
       listen   80;
       server_name myserver.com www.myserver.com;
       return 301 https://$server_name$request_uri;
 }

3) I use FULL (strict) SSL in Cloudflare, so I generate the free crt and key files from their website. Then I cat them to the respective crt and key files in /usr/local/ngnix/conf/ssl/myserver/

It works.

My questions:

1) What's the file dhparam.pem in /usr/local/ngnix/conf/ssl/myserver/ for? I found that I could actually delete it and also deleted the corresponding line in myserver.ssl.conf. Then ngxrestart, it still works.

2) Why can't I get a pretty green encryption lock for my website? I understand it means I got a mixed kind of website - SSL and non-SSL. But I've forwarded all the http to https. The website content is the default one. How do I get a green lock?

3) Now my SSL cert is issued by Cloudflare and issued to sni.cloudflaressl.com which I guess is shared by many other websites.

So if I want to have it issued to myserver.com, I need to purchase a cert from "trusted CA" ($5/month for Cloudflare) or get a cert from Letsencrypt for free.




Other than aesthetic reasons, does it really make a difference in security sense between these two types of encryption methods?

4) For the case above, what happens when the cert expires in Oct? Will CloudFlare renew it automatically?

---

5) What is the purpose of using letsencrypt SSL instead of a paid Cloudflare SSL? It's only the price difference or there is some other advantages?

6) I remember it's mentioned to use only the DNS of Cloudflare insterad of the proxied one (orange cloud). Why?

Sorry for all these questions. Obviously I'm not really a very experienced system admin. But I'm eager to learn.

Thanks a lot.

 

Thanks eva2000. I feel touched to have got your answers. My mind is so clear now... kind of.

SSL is so confusing.. So am I all good now regarding the SSL functionality part and can move on to next step?

I notice there's a cloudflare.conf I think it's related to reveal the true IPs of visitors （I'm not using it now）? If I don't configure/use it, I only get the IPs from cloudflare in the server logs, right? ///NO. I just checked the access.log, it actually shows my IP, not the IP of cloudflare...

And what's Authenticated Origin Pulls now? Do I need to use it?