Search code examples
sslnginxhttpscloudflare

Cloudflare SSL cert throws a Security Issue

I have configured my nginx to use the certificate and private_key that I downloaded from cloudflare crypto.

This is my nginx.conf file-

server {
        listen 443 ssl http2;
        listen [::]:443 ssl http2;

        server_name autocaptions.app *.autocaptions.app;

        location / {
                proxy_pass http://127.0.0.1:7887;
        }
        ssl on;
        ssl_certificate /home/ubuntu/sslcerts/autocaptions.pem;
        ssl_certificate_key /home/ubuntu/sslcerts/private-key.pem;
        # ssl_client_certificate /home/ubuntu/sslcerts/cloudflare.crt;
        # ssl_verify_client on;
}


# Redirect http to https
server {
        listen 80;
        listen [::]:80;
        return 301 https://$host$request_uri;
}

I am not sure what the issue is. I have added the certificate and the private_key.

I see the following error in the browser when I try to access https://autocaptions.app -

Browser Error

Error in text-

autocaptions.app has a security policy called HTTP Strict Transport Security (HSTS), which means that Firefox can only connect to it securely. You can’t add an exception to visit this site.

In Cloudflare configuration, I have disabled HSTS, not sure why this error is showing up.

I have followed digitalocean tutorial to configure SSL.

Solution

  • You are using a certificate signed by the "Cloudflare Origin CA". Certificates issued by this CA are intended to be installed on your origin server so that the communication between the Cloudflare CDN and your origin server can be protected by a certificate.

    These kind of certificates are not intended on systems facing end users (i.e. browsers). They are only intended to secure the communication between your origin server and Cloudflare. Typical end users will not have the "Cloudflare Origin CA" as a trusted CA in their browser and thus they will get a TLS error when connecting to your origin server - and this is thus what you get. But typical end users should not connect to the origin server in the first place - they should connect to the Cloudflare instance instead. Only Cloudflare itself should connect to the origin server and they will acknowledge their own CA as trusted.