iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To use a Cloudflare Origin CA certificate with Apache on Ubuntu, create a PEM certificate that covers every hostname your virtual host serves, save its private key separately, configure Apache on port 443, and then select Full (strict) in Cloudflare. The certificate encrypts the Cloudflare-to-server connection; it is not trusted by browsers when someone connects directly to your server. That distinction explains most NET::ERR_CERT_AUTHORITY_INVALID reports. The procedure below covers certificate creation, secure file permissions, Apache configuration, validation, Cloudflare settings, renewal, and recovery when strict mode fails.
What does a Cloudflare Origin CA certificate protect?
A Cloudflare Origin CA certificate establishes HTTPS between Cloudflare’s edge and your Apache origin. Visitors normally connect to Cloudflare, while Cloudflare connects to Apache over the certificate you install. It is therefore an origin certificate, not a publicly trusted browser certificate.
Cloudflare describes Origin CA certificates as encrypting traffic “between Cloudflare and your origin,” not traffic from client browsers to the origin. If a DNS record is unproxied, a visitor uses the server directly, or a person enters the origin IP address, a browser can reject the certificate authority even though Apache and Cloudflare are configured correctly.
| Characteristic | Cloudflare Origin CA | Publicly trusted certificate |
|---|---|---|
| Trust audience | Cloudflare’s connection to the origin | Browsers and other clients connecting directly |
| Issuance path | Created in the Cloudflare dashboard or through the Origin CA API | Issued by an external public certificate authority |
| Direct-origin browsing | Usually produces an authority error | Works when the name, validity, and chain are correct |
| Cloudflare encryption mode | Designed for Full (strict) after installation | Also compatible with Full (strict) |
| Operational warning | Cloudflare currently does not send expiry notifications | Notification and renewal features depend on the public CA |
Use Origin CA when every relevant client path goes through Cloudflare. Use a public certificate instead, or in addition, when administrators, health checks, API clients, or users must reach the origin directly.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
What should I check before creating the certificate?
First decide exactly which names Apache must answer for. A certificate is useful only when its Subject Alternative Name (SAN) list matches the hostname in the TLS request.
Confirm DNS and proxying
- Create or verify DNS records for the apex name,
www, and each required subdomain. - Set the records that depend on Origin CA to Proxied in Cloudflare. A DNS-only record sends clients straight to Apache and exposes the private trust boundary.
- Make sure the origin accepts TCP port 443 from Cloudflare and that any host firewall or cloud security group allows it.
Plan SANs and wildcards
Cloudflare allows up to 200 individual SANs on an Origin CA certificate. One-level wildcards are supported: a name such as *.example.com covers app.example.com, but it does not cover east.app.example.com or the apex example.com. Add the apex separately when it is needed. IP addresses cannot be used as SANs, so an origin IP cannot be covered by this certificate.
Gather access and a maintenance window
- Use a Cloudflare account role allowed to create Origin CA certificates. Account or member API access is also required for creation and revocation operations.
- Have root or equivalent sudo access on Ubuntu so you can write under
/etc/ssl, edit Apache sites, and reload the service. - Keep a tested way to reach the server locally or through a management channel in case a configuration error prevents Apache from reloading.
How do I create an Origin CA certificate in Cloudflare?
Create the certificate before changing Apache, and copy the private key while Cloudflare displays it. Cloudflare does not show that private key again after you leave the creation screen.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →- Sign in to Cloudflare and open SSL/TLS → Origin Server → Origin Certificates.
- Select Create Certificate.
- Choose Cloudflare-generated key material (RSA or ECC), or select the option to submit your own CSR if your key-management policy requires it.
- Enter every hostname that the Apache HTTPS virtual host will serve. Include the apex and any aliases explicitly; add a supported one-level wildcard only when it represents the names you actually operate.
- Choose the validity period that fits your rotation policy. A longer period reduces immediate replacement work, but it does not remove the need for expiry monitoring.
- Select PEM for Apache/OpenSSL. PEM is Base64-encoded text and is the normal format for Apache certificate directives.
- Create the certificate, then copy the signed Origin Certificate and Private Key into separate temporary files. Do not paste them into the same file, a shell history entry, a ticket, or a public repository.
Cloudflare states that servers using OpenSSL, including Apache and NGINX, generally expect PEM files, although binary DER files can also be used. Apache’s configuration below assumes PEM.
Where should I store the certificate and private key on Ubuntu?
Keep the public certificate in a system certificate directory and the private key in the private directory, with different permissions. The certificate can be readable by processes that need to inspect it; the key should be readable only by root and the tightly controlled Apache startup path.
- Create or use the standard directories:
sudo install -d -m 755 /etc/ssl/certs
sudo install -d -m 710 /etc/ssl/private- Install the files with clear names. Replace the temporary paths with the files you created in the dashboard:
sudo install -m 644 /tmp/cloudflare-origin.pem /etc/ssl/certs/cloudflare-origin.pem
sudo install -m 600 /tmp/cloudflare-origin.key /etc/ssl/private/cloudflare-origin.key- Remove temporary copies after checking that the destination files are correct, and retain an encrypted, access-controlled backup of the key according to your incident-response policy.
Do not make the key world-readable to solve a permission error. If Apache cannot read it, inspect ownership, directory traversal permissions, and the account that starts Apache. A private key may also be passphrase-protected; Ubuntu notes that a passphrase prompt can be required depending on how the key was obtained, which can prevent unattended restarts unless you have an approved key-unlock design.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Do I need a Cloudflare Origin CA chain file?
Some Apache deployments need the matching Cloudflare Origin CA RSA or ECC root chain presented or installed separately. Download the chain that corresponds to the certificate type you selected and store it as another root-owned PEM file. Add a chain directive only when your Apache build and certificate chain require it; do not substitute an unrelated public CA bundle.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How do I configure Apache 2 on Ubuntu for the certificate?
Ubuntu’s baseline is to enable the SSL module, enable an HTTPS site, validate the configuration, and reload Apache. A named virtual host is preferable when the server hosts more than one site.
Enable SSL and an HTTPS site
sudo a2enmod ssl
sudo a2ensite default-ssl
sudo apache2ctl configtest
sudo systemctl restart apache2.serviceThe default-ssl site is a quick baseline. For a real site, create or edit a file such as /etc/apache2/sites-available/example-ssl.conf and enable that file instead:
sudo a2ensite example-ssl.confBuild the 443 virtual host
Use a separate <VirtualHost *:443> block for the names in the certificate. The following is a minimal pattern; keep your existing document root, logging, directory rules, and application settings.
<VirtualHost *:443>
ServerName example.com
ServerAlias www.example.com
DocumentRoot /var/www/html
SSLEngine on
SSLCertificateFile /etc/ssl/certs/cloudflare-origin.pem
SSLCertificateKeyFile /etc/ssl/private/cloudflare-origin.key
# Add this only if your Apache build requires the matching chain:
# SSLCertificateChainFile /etc/ssl/certs/cloudflare-origin-ca.pem
ErrorLog ${APACHE_LOG_DIR}/example-ssl-error.log
CustomLog ${APACHE_LOG_DIR}/example-ssl-access.log combined
</VirtualHost>Replace ServerName and every ServerAlias with names present in the certificate SAN list. If another enabled virtual host claims the same name, Apache may present that host’s certificate instead.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchValidate before reloading
- Run
sudo apache2ctl configtest. Continue only when it reportsSyntax OK. - Check that the key and certificate paths exist and that the key is not truncated or accidentally copied with dashboard formatting.
- Reload without dropping existing connections:
sudo systemctl reload apache2Use a full restart only when a module or startup condition requires it. If Apache fails, inspect sudo systemctl status apache2 and the service journal, correct the first reported syntax, path, permission, or key problem, run the configuration test again, and then restart.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Should Cloudflare use Full or Full (strict)?
After Apache is serving the intended certificate on port 443, choose Full (strict) in Cloudflare’s SSL/TLS → Overview page when all origin hosts are protected by valid Cloudflare Origin CA certificates or publicly trusted certificates.
Cloudflare’s deployment sequence is to upload or create the certificate, update the origin web-server configuration, install the root chain where required, enable SSL and port 443, and only then change the encryption mode. Switching first can produce an avoidable 526-style origin validation failure.
Full encrypts the Cloudflare-to-origin leg but is less strict about what the origin presents. It can hide an expired, mismatched, or otherwise unsuitable certificate. Treat it as a transitional diagnostic setting, not as a reason to leave a known-bad certificate in production. Once every origin is correctly covered, Full (strict) provides the intended hostname and validity checks.
Recommended Free Tools
How can I verify the certificate and trust boundary?
Test through the proxied hostname first, then test the origin deliberately with the expectations of a private CA.
Check the public path
curl -I https://example.com
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/nullConfirm that the response is from the expected site and inspect the certificate details. To examine a saved certificate locally:
openssl x509 -in /etc/ssl/certs/cloudflare-origin.pem
-noout -subject -issuer -dates -ext subjectAltNameThe SAN output must contain the hostname being requested, the validity dates must include the current date, and the issuer and chain must correspond to the selected Cloudflare RSA or ECC certificate.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Check the Apache virtual host
- Verify that Apache is listening on 443:
sudo ss -ltnp | grep ':443'. - Run
sudo apache2ctl -Sto see which virtual host owns each name and address. - Confirm Cloudflare DNS is still proxied for the hostname under test.
- Check the origin firewall and cloud security group if Cloudflare cannot connect.
Understand direct-origin errors
A direct browser request to the origin IP, or a temporary DNS-only record, can show NET::ERR_CERT_AUTHORITY_INVALID. That result is expected for an Origin CA certificate because browsers do not include Cloudflare’s private origin authority in their public trust stores. Re-enable proxying for the Cloudflare-only design, or replace the origin certificate with one issued by a public CA if direct access is a requirement.
For a diagnostic direct test, you can use a hostname-resolving tool such as curl --resolve example.com:443:ORIGIN_IP https://example.com/. A trust failure in that test confirms the private-CA boundary; it does not justify adding -k to production clients.
What do common Cloudflare and Apache errors mean?
| Symptom | Likely cause | Fix |
|---|---|---|
| Browser authority error after bypassing Cloudflare | The browser is being shown a private Origin CA certificate. | Restore proxying, or install a publicly trusted certificate for direct-origin traffic. |
| Issuer or chain cannot be found | Apache or the connecting service needs the matching Cloudflare RSA or ECC root chain. | Install the correct PEM chain and add the chain directive only if that Apache build requires it; reload and test again. |
| Full (strict) fails while Apache starts | The served certificate is expired, does not match the hostname, has an incomplete chain, or belongs to another 443 virtual host. | Inspect SANs and validity, run apache2ctl -S, verify the served chain with openssl s_client, and correct the selected virtual host. |
| Apache will not start after an SSL edit | Syntax error, wrong path, restrictive directory permissions, malformed PEM, key mismatch, or a passphrase prompt. | Run sudo apache2ctl configtest, read the first error in the service journal, fix the path or permissions, and repeat the test before restarting. |
| Cloudflare cannot reach the origin | Port 443 is closed, the security group blocks Cloudflare, Apache is bound elsewhere, or the DNS record points to the wrong address. | Check ss, host and cloud firewall rules, the DNS target, and Apache’s listening addresses. |
| Certificate creation or revocation is denied | The Cloudflare user lacks the required account or member API access. | Ask an account administrator to enable the required access, then retry the dashboard or API operation. |
How should I renew and monitor an Origin CA certificate?
Cloudflare currently does not send expiration notifications for Origin CA certificates. Put the expiry date in an independent certificate inventory and alert well before it, with enough time to issue, install, validate, and roll back a replacement.
A safe rotation sequence
- Issue a replacement certificate containing the same SANs and any newly required names. Keep the current certificate active while you prepare it.
- Copy the new PEM certificate and key to protected temporary files, then install them under new filenames in
/etc/ssl/certsand/etc/ssl/private. - Update the virtual host paths, run
sudo apache2ctl configtest, and reload Apache. - Test the proxied hostname and inspect the served certificate’s subject, SANs, issuer, and expiry.
- Only after verification, remove the old files according to your retention policy and update the inventory.
API automation can list, create, retrieve, and revoke Origin CA certificates. Cloudflare requires an API token with the Zone - SSL and Certificates - Edit permission for those operations. Store that token in a secret manager, restrict its scope, and log rotations without logging private keys.
Revocation is irreversible. If a key is lost or a certificate must no longer be trusted, plan the replacement first and account for the temporary Cloudflare encryption-mode implications before revoking the old certificate.
Is Cloudflare Origin CA or a public certificate the better choice?
The correct choice depends on who must trust the certificate and how much of the service is guaranteed to stay behind Cloudflare.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
| Decision question | Origin CA is suitable when… | A public certificate is preferable when… |
|---|---|---|
| Who connects to the origin? | Only Cloudflare’s edge and controlled origin-to-origin paths connect. | Browsers, monitoring systems, partners, or administrators connect directly. |
| How are names covered? | Your SAN and one-level wildcard plan fits the Cloudflare limits, with no IP SAN requirement. | You need a public-CA product or validation workflow that better fits unusual names or external clients. |
| How will renewal work? | You can maintain your own expiry inventory and rotation automation. | You want the selected public CA’s notification, validation, or managed-renewal features. |
| What happens if proxying is disabled? | You accept that direct clients may reject the private certificate. | The service must continue to be trusted during DNS, incident-response, or migration changes. |
| What is the failure impact? | A strict-mode failure is handled by checking SANs, dates, chain, and the Apache vhost. | The public chain and direct-client trust remain available, subject to the CA’s own renewal and revocation rules. |
Many organizations use a public certificate on an origin that has mixed access requirements, while using Origin CA on hosts that are deliberately unreachable except through Cloudflare. Document that decision per hostname so a future DNS change does not create a surprise browser error.
Frequently Asked Questions
Can I use an Origin CA certificate on an Apache server that is never proxied through Cloudflare?
Apache can load the file, but ordinary browsers and most public clients will not trust it because the Origin CA is private. If the server must operate independently of Cloudflare, obtain a certificate from a publicly trusted certificate authority instead.
Can one Origin CA certificate cover both the root domain and all nested subdomains?
The apex name must be listed separately; a one-level wildcard does not cover the apex or deeper names. Map every Apache ServerName and ServerAlias to an explicit SAN or to a wildcard at the correct level before issuing the certificate.
Free tools Windows power users keep installed
One-click scans. No signup required.
What should I do if the private key was copied incorrectly or lost?
Do not try to reconstruct it from the certificate; a certificate cannot be used to recover its private key. Generate a new key and certificate, install and verify the replacement, then revoke the old certificate if compromise or loss means it should no longer be trusted.
Will replacing the certificate interrupt existing website connections?
A normal Apache reload keeps existing workers serving current connections while new handshakes use the replacement certificate. Schedule the change with a rollback path, and use a full restart only when your module or key-unlock design requires it.
How can I prove that Cloudflare, rather than Apache, is serving the visitor certificate?
Compare a normal request to the proxied hostname with a controlled origin test using the origin address and the same SNI name. The public request should show the edge certificate, while the origin test reveals the Apache certificate and confirms which virtual host answers on port 443.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
