Overview

Install and Use Cloudflare SSL for All Web Servers (Nginx, Apache, Caddy)

Cloudflare provides free SSL certificates that work with Nginx, Apache, and Caddy. You can set up Cloudflare SSL using either Full or Full (Strict) mode.

Step 1: Sign Up & Add Your Domain to Cloudflare

  1. Go to Cloudflare: https://www.cloudflare.com
  2. Sign up and add your domain.
  3. Change your domain’s nameservers to the ones provided by Cloudflare.
  4. Wait for DNS propagation (can take a few minutes to hours).

Step 2: Configure SSL/TLS in Cloudflare

  1. Go to the Cloudflare Dashboard.
  2. Navigate to SSL/TLS → Overview.
  3. Choose one of the following SSL modes:
    • Flexible: Encrypts traffic between the browser and Cloudflare, but not between Cloudflare and your server. (Not recommended, as it’s insecure).
    • Full: Encrypts traffic end-to-end but does not verify the certificate on your server. (Works with self-signed certificates).
    • Full (Strict) [Recommended]: Encrypts traffic end-to-end and verifies the certificate on your server. Requires a valid SSL certificate on your server.

Step 3: Generate & Install an SSL Certificate (For Full or Full Strict Mode)

Cloudflare provides a free 15-year SSL certificate for your server.

  1. Go to SSL/TLS → Origin Server
  2. Click Create Certificate
  3. Choose:
    • Key Type: RSA (2048)
    • Certificate Validity: 15 years
  4. Copy the certificate and private key.
  5. Install them on your server.

Step 4: Install SSL on Your Web Server

For Nginx

  1. Save the SSL files:

    sudo nano /etc/ssl/cloudflare.crt

    Paste the certificate from Cloudflare and save.

    sudo nano /etc/ssl/cloudflare.key

    Paste the private key from Cloudflare and save.

  2. Update the Nginx configuration:

    server {
    listen 443 ssl;
    server_name example.com;
    ssl_certificate /etc/ssl/cloudflare.crt;
    ssl_certificate_key /etc/ssl/cloudflare.key;
    location / {
        root /var/www/html;
        index index.html;
        }
}

  3. Restart Nginx:

    sudo systemctl restart nginx

For Apache

  1. Save the SSL files:

    sudo nano /etc/ssl/cloudflare.crt

    Paste the certificate from Cloudflare and save.

    sudo nano /etc/ssl/cloudflare.key

    Paste the private key from Cloudflare and save.

  2. Update the Apache configuration:

    <VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile /etc/ssl/cloudflare.crt
    SSLCertificateKeyFile /etc/ssl/cloudflare.key
    DocumentRoot /var/www/html
</VirtualHost>

  3. Restart Apache:

    sudo systemctl restart httpd    # CentOS/RHEL

For Caddy

  1. Edit the Caddyfile:

    sudo nano /etc/caddy/Caddyfile

  2. Add the following configuration:

    example.com {
    root * /var/www/html
    file_server
    tls /etc/ssl/cloudflare.crt /etc/ssl/cloudflare.key 
}

  3. Restart Caddy:

    sudo systemctl restart caddy

Step 5: Enable HTTPS Redirect in Cloudflare

  1. Go to SSL/TLS → Edge Certificates.
  2. Enable Always Use HTTPS to redirect all HTTP traffic to HTTPS.
  3. Set Automatic HTTPS Rewrites to ON.

Step 6: Verify SSL is Working

Final Notes

  • If using Full (Strict) mode, make sure your server has a valid SSL certificate.
  • Cloudflare handles SSL termination, improving security and performance.
  • Always restart your web server after updating SSL configurations.