Cloudflare Origin CA with Full (Strict) on an nginx shield

Full (Strict) asks Cloudflare to verify the certificate on the server behind it. Cloudflare Origin CA certificates are built for that hop: free, trusted by Cloudflare, and a good fit for a shield reverse proxy.

Visitor TLS vs shield TLS

Visitors finish HTTPS at Cloudflare. That part is familiar.

The next hop—Cloudflare to your shield—still needs a certificate Cloudflare will accept when SSL mode is Full (Strict).

Origin CA is aimed at that middle hop. Your origin can keep whatever TLS you prefer on the private connection from the shield.

How ShieldProxy helps

When you add a domain, the panel can request and install Origin CA material on the shield and point nginx at it.

When you remove a domain, cleanup includes the related reverse-proxy site and, where possible, the matching certificate work—so leftovers do not pile up.

FAQ

Is Let’s Encrypt required on the shield?
Not for the Cloudflare→shield hop if you use Origin CA. Many teams still use Let’s Encrypt or another cert on the origin itself; that is separate.

Keep reading

More in Guides

All guides →

Explore topics