Let's Encrypt SSL Validation Fails When Using Cloudflare Print

Let’s Encrypt SSL Validation Fails When Using Cloudflare

If your hosting account cannot issue or renew a Let’s Encrypt SSL certificate while your website uses Cloudflare, the domain validation request may not be reaching your hosting server correctly.

For websites that always use Cloudflare’s proxy, Cloudflare Origin CA provides an alternative certificate for securing the connection between Cloudflare and your hosting server.

Why does validation fail?

Before issuing a certificate, Let’s Encrypt must confirm that you control the domain. With HTTP validation, your hosting server creates a temporary file at:

http://yourdomain.com/.well-known/acme-challenge/<token>

Let’s Encrypt must retrieve the expected content from this address. If it receives an error or a different response, validation fails.

When your DNS record is set to Proxied in Cloudflare—the orange cloud setting—requests pass through Cloudflare before reaching your hosting server. Using Cloudflare only for DNS does not introduce this proxy layer.

Depending on your configuration, possible causes include:

• A security rule or login requirement blocks the validation file.
• A redirect loop or rewrite sends the request to the wrong location.
• Cloudflare cannot connect to your hosting server.
• The domain points to a server that does not contain the validation file.

Cloudflare does not automatically prevent Let’s Encrypt validation. Validation can succeed through the proxy when the expected response remains accessible. A normal HTTP-to-HTTPS redirect alone does not necessarily cause failure.

Learn more about Let’s Encrypt validation and Cloudflare proxy settings.

Alternative solution: Cloudflare Origin CA

Cloudflare Origin CA certificates secure the connection from Cloudflare to your hosting server. They are suitable when visitors access your website through Cloudflare’s proxy.

This replaces the need for a Let’s Encrypt certificate on that connection; it does not repair the failed Let’s Encrypt validation.

Important: Origin CA certificates are not publicly trusted by browsers. Keep the website proxied through Cloudflare. Pausing Cloudflare or changing the record to DNS only can expose visitors to certificate warnings.

See Cloudflare’s Origin CA guide.

How to install a Cloudflare Origin CA certificate

1. Sign in to Cloudflare and select your domain.
2. Open SSL/TLS → Origin Server, then select Create Certificate.
3. Choose a key option, confirm the hostnames to protect, and select a validity period.
4. Create the certificate and securely save the certificate and private key. Cloudflare will not display the generated private key again.
5. Install them on your hosting server using its custom SSL installation feature. Add the Origin CA chain if required.

Follow Cloudflare’s complete installation instructions for server-specific guidance. Record the expiration date and arrange replacement before expiry.

Enable Full (strict) encryption

After installation:

1. Confirm that your hosting server accepts HTTPS connections on port 443.
2. Confirm that the installed certificate is valid and covers the required hostname.
3. In Cloudflare, open SSL/TLS → Overview.
4. Set the applicable encryption mode to Full (strict).

If changing this setting for the entire domain, first check that all affected origin hosts have suitable certificates.

See Cloudflare’s Full (strict) requirements.

Verify your website

Visit your website over HTTPS and test the main domain and relevant subdomains.

Cloudflare uses separate certificates for two connections:

• Visitor to Cloudflare: The certificate presented to your visitor’s browser.
• Cloudflare to your hosting server: The certificate installed on your server.

The certificate shown in your browser does not, by itself, confirm which certificate is installed on your hosting server.

If Cloudflare displays Error 526, check the origin certificate’s installation, validity dates, and hostname coverage against the Full (strict) requirements.

Can I continue using Let’s Encrypt?

Yes. If visitors or services must connect directly to your hosting server, keep a publicly trusted certificate.

You can troubleshoot access to the HTTP validation file or, if your hosting platform supports it, use DNS validation. DNS validation verifies a TXT record and does not require the website validation file to be accessible through Cloudflare.

See Let’s Encrypt’s validation options.

Need help?

Contact our support team with:

• The affected domain.
• The exact validation error.
• Whether its Cloudflare DNS record is Proxied or DNS only.

Do not include your private key in your support request.