With Cloudflare proxying your domain, visitors connect to Cloudflare over HTTPS — but the link from Cloudflare to your server must be encrypted too. An Origin Certificate is free, valid for up to 15 years and trusted by Cloudflare.

1. Create the certificate

Cloudflare dashboard → your domain → SSL/TLS → Origin Server → Create Certificate. Keep the default RSA key, hostnames example.com and *.example.com, validity 15 years. Copy the certificate and the private key (the key is shown only once).

2. Install on the server

sudo mkdir -p /etc/ssl/cloudflare
sudo nano /etc/ssl/cloudflare/example.com.pem   # paste the certificate
sudo nano /etc/ssl/cloudflare/example.com.key   # paste the private key
sudo chmod 600 /etc/ssl/cloudflare/example.com.key

3. Nginx server block

server {
    listen 443 ssl;  listen [::]:443 ssl;
    server_name example.com www.example.com;
    ssl_certificate     /etc/ssl/cloudflare/example.com.pem;
    ssl_certificate_key /etc/ssl/cloudflare/example.com.key;
    add_header Strict-Transport-Security "max-age=31536000" always;
    root /var/www/example.com;
    # ... your site config ...
}
server { listen 80; listen [::]:80; server_name example.com www.example.com; return 301 https://$host$request_uri; }

sudo nginx -t && sudo systemctl reload nginx

4. Cloudflare settings

• SSL/TLS mode: Full (strict).
• Edge Certificates: Always Use HTTPS on, minimum TLS 1.2, TLS 1.3 on.
• DNS records for @ and www: Proxied (orange cloud).

Troubleshooting

Full setup from scratch: free Oracle Cloud server + one setup script.