Cloudflare Origin CA with Full (Strict) on an nginx shield
Full (Strict) asks Cloudflare to verify the certificate on the server behind it. Cloudflare Origin CA certificates are built for that hop: free, trusted by Cloudflare, and a good fit for a shield reverse proxy.
Visitor TLS vs shield TLS
Visitors finish HTTPS at Cloudflare. That part is familiar.
The next hop—Cloudflare to your shield—still needs a certificate Cloudflare will accept when SSL mode is Full (Strict).
Origin CA is aimed at that middle hop. Your origin can keep whatever TLS you prefer on the private connection from the shield.
How ShieldProxy helps
When you add a domain, the panel can request and install Origin CA material on the shield and point nginx at it.
When you remove a domain, cleanup includes the related reverse-proxy site and, where possible, the matching certificate work—so leftovers do not pile up.
FAQ
- Is Let’s Encrypt required on the shield?
- Not for the Cloudflare→shield hop if you use Origin CA. Many teams still use Let’s Encrypt or another cert on the origin itself; that is separate.
Keep reading
- Cloudflare + Nginx Reverse Proxy IntegrationConnect Cloudflare OAuth or API token to ShieldProxy for DMCA-ignore reverse-proxy automation—proxied DNS, Origin CA, and nginx on your shield VPS.
- What Is a DMCA-Ignore Reverse Proxy?DMCA-ignore reverse proxy explained: Cloudflare + shield nginx VPS in front of your origin so the real server IP stays private.
- DIY Nginx Reverse Proxy vs ShieldProxy PanelDIY Cloudflare + nginx reverse proxy to hide origin IP vs ShieldProxy—automate DNS, Origin CA, and teardown for DMCA-ignore and Offshore Hosting shields.
- Nginx Reverse Proxy to Hide Origin IP (Cloudflare)Nginx reverse proxy + Cloudflare to hide origin IP—the classic DMCA-ignore reverse-proxy recipe. How ShieldProxy automates DNS, Origin CA, and nginx sites on the shield VPS.
More in Guides
Explore topics
- Use casesStreaming DMCA-ignore reverse proxies, multi-domain nginx shields, hide origin IP, Fully Managed vs Self-Managed plans.
- CompareCloudflare-only vs DMCA-ignore reverse proxy, and DIY nginx reverse proxy vs ShieldProxy automation.
- IntegrationsCloudflare DNS + Origin CA for your nginx reverse-proxy shield—no shared platform Cloudflare login.