Using OpalStack's OpenSSL with Cloudflare's DNS

loupgarou

igor i'll think about changing all the contents to https.

For the moment the site seems to work correctly, i've done the following procedure:

the domain was added to cloudflare, along with the relatives WWW and A records.
I've disabled the "proxy" feature to the A and WWW records.
I've used the widget inside opalstack to request a free LE certificate and i've applied to the routing. I have NOT checked the option "redirect to https"
back to cloudflare, i've enabled the "Full/Strict" ssl certification (which requires to have a valid certificate on the origin server).
Everything seems ok so far, beside the fact that the HTTP/2 option inside cloudflare is disabled?

igor

When you disable the proxy feature you are bypassing Cloudflare and using it just as DNS. You will need to enable it to use their features like HTTP/2, caching, etc.

sean

👋 hi all, we now support automatic LE for sites that are running behind Cloudflare.

Please try it out and let me know how goes 🙂

zgp

Hello sean - I've transferred a site from webfaction to Opalstack (thanks v much for your tools - so helpful!). The DNS goes through Cloudflare and it all seems to be working except that when I request a Lets Encrypt cert via the Opalstack site route after a few minutes I get the message:

Lets Encrypt failed to generate a certificate for your site: pweventhire. The site is served by a CDN which produced a redirect at the challenge URL.

At cloudflare I have turned off SSL / TLS encryption mode to see if that was getting in the way but this hasn't made a difference.

If you have any ideas about how to get the cert issued I'd really appreciate it? Thanks!

kptac

Received this notice:

Lets Encrypt failed to generate a certificate for your site: <site_name>. The site is served by a CDN which produced a redirect at the challenge URL.

How can we resolve this?

I do have a page rule setup in cloudflare:

.<domain>/.well-known/acme-challenge/
SSL: Off, Automatic HTTPS Rewrites: Off

But that didnt help either. Please advice.

Note: After disabling DNS proxy status for the domain from "Proxied" to "DNS Only". The certificate was generated.

sean

kptac we can't issue LE certs if you're doing HTTPS redirection upstream at Cloudflare because the the verification step is done over HTTP, not HTTPS.

To work around this turn off your HTTPS redirection at Cloudflare and turn it on for your site at Opalstack.

sean

kptac .<domain>/.well-known/acme-challenge/
SSL: Off, Automatic HTTPS Rewrites: Off

Did you have this rule set up for every domain and subdomain that's attached to the site at Opalstack?

kptac

I believe the best way is what you recommended earlier and install origin certificate from cloudflare. That's what I'll be doing in my case.

kptac

sean, had a similar situation with a new domain and cloudflare. I tried setting both rules, with domain.com and *.domain.com but LE failed to generate with this msg:

Lets Encrypt failed to generate a certificate for your site: <site_name>. The site is served by a CDN which produced a redirect at the challenge URL.

kptac

Yes, I have the rule as: *.<domain>/.well-known/acme-challenge/* setup for main domain and www.domain. Ideally, that should've taken care of it. Is it because I had "Redirect to https" ticked as well in sites settings which probably led to a redirect loop or something? not sure.

sean

kptac If your rule was for *.domain.com then you'll need a second rule for domain.com since we test every domain that's attached to the site.

kptac

sean oh my bad, I didn't realize it! I have run out of the free 3 page rules, so I generated an origin certificate from CF, which works well for now.

sean

kptac that's pretty weird, we do test <domain>/.well-known/acme-challenge/ for a redirect but if you have the page rule set up then it shouldn't redirect.

If this is still failing for you then please feel free to email support with the details, ie the domain and page rules, and we'll be happy to look into it further.

sean

zgp It's not the encryption mode that is the problem. The problem is that you have a page rule or something that redirects all requests to HTTPS.

We do the verification check over HTTP (since the site won't have a certificate yet) so if everything redirects to HTTPS we can't do that.

If that doesn't seem to be the case for you then please email support with the details (domain and site) and we'll look into it further.

zgp

sean Thanks Sean - I can't see any page rules or redirects anywhere. I will contact support to see if they can help - thank you!

« Previous Page