Cloudflare Origin SSL certificate

How to Configure Cloudflare Origin CA for Apache

Last updated on

Cloudflare Origin CA provides a secure SSL connection between your server (“origin”) and Cloudflare. In this article we will configure an Origin cert for Apache on Ubuntu 18.04 / 19.10, though it should also be useful for other Linux distros.


You should already have your Apache server configured and serving web pages for your domain. We have several guides to help you set up an Apache web server from scratch on Ubuntu 18.04 / 19.10.

1. Generate Cert and Private Key

Log in to Cloudflare and navigate to the Crypto page.

Scroll down to Origin Certificates and click Create Certificate.

Cloudflare Origin certificate

In Origin Certificate Installation, the defaults should be Private Key Type: RSA with 15 years validity. Click Next.

Cloudflare Origin certificate

In the next screen, the Key format should be PEM (default) and Web Server for Installation: Apache httpd.

Copy your Origin Certificate and Private Key to a text editor for later. We will need to paste these into Linux.

Finally, click OK to close.

Cloudflare Origin certificate

2. Copy Cert and Key to Server

Create a new directory where our Cert and Key will reside.

sudo mkdir -p /etc/cloudflare/

Using nano text editor, create a new file (where is your own domain).

sudo nano /etc/cloudflare/

Now paste in your Origin Certificate from Cloudflare.  Save file and exit. (Press CTRL + X, press Y and then press ENTER)

Create a new file (where is your own domain).

sudo nano /etc/cloudflare/

Paste in your Private Key from Cloudflare.  Save file and exit. (Press CTRL + X, press Y and then press ENTER)

3. Configure Apache

Firstly, make sure you have the SSL module enabled for Apache by running:

sudo a2enmod ssl

Open the Apache configuration file for your domain. This is usually located in /etc/apache2/sites-available/

sudo nano /etc/apache2/sites-available/

There should already be a block for <VirtualHost *:80>. You need to add a new block underneath it for SSL port 443. You can also add a rewrite condition in your port 80 block to redirect all requests to https.

Below is an example.

<VirtualHost *:80>

    ServerAdmin [email protected]
    DocumentRoot /var/www/
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    RewriteEngine on
    RewriteCond %{SERVER_NAME} [OR]
    RewriteCond %{SERVER_NAME}
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]


<VirtualHost *:443>

    ServerAdmin [email protected]
    DocumentRoot /var/www/
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    SSLEngine on
    SSLCertificateFile /etc/cloudflare/
    SSLCertificateKeyFile /etc/cloudflare/


Save file and exit. (Press CTRL + X, press Y and then press ENTER)

Test the configuration syntax for errors.

apachectl configtest

You can ignore any errors that say Could not reliably determine the server’s fully qualified domain name

If you see Syntax OK, restart Apache.

sudo systemctl restart apache2

Note, it can take 5 or 10 minutes for Cloudflare to deploy certs.

Make sure that SSL in Cloudflare is set to Full (Strict). This will ensure that data between Cloudflare and your server is always encrypted.

Getting the Real Client IP Address from Cloudflare in Apache

While you’re still here.. I recently wrote an article which may be of interest to you.

As may or may not know, when you enable Cloudflare on your site, the IP address that appears in your Apache access and error logs is that of the Cloudflare proxy and not the real client’s IP. As you can imagine, this is a security concern should you ever need to audit your logs or use IP restrictions with .htaccess.

Thankfully, Cloudflare sends the real client IP in the HTTP headers as CF-Connecting-IP, and you can configure Apache to use this IP in your logs instead of Cloudflare’s proxy IP.

Let me know in the comments if this helped. Follow me on Twitter, Facebook and YouTube.

p.s. I increased my AdSense revenue by 68% using AI 🤖. Read my Ezoic review to find out how.

1 Star2 Stars3 Stars4 Stars5 Stars 5.00 (3 votes)

Leave a Reply

Your email address will not be published. Required fields are marked *

We use Markdown to style comments, like on Github and Reddit.
To do a line break, type two spaces after the sentence.
You can add inline code by wrapping it in backticks: `code here`

    To do an entire block of code  
    type four spaces before the line
    and it will appear in a block like this.
    <-- four empty spaces

9 replies

anyone know how to include the root origin cert? how do we use it when cloudflare already generated the normal certificate.

do we add it to the end of that file ? any help much appreciated

AH00526: Syntax error on line 26 of /etc/apache2/sites-enabled/example.conf:
Invalid command ‘SSLEngine’, perhaps misspelled or defined by a module not included in the server configuration
Action ‘configtest’ failed.

I get as far as the virtual host bit and when I type the command it opens nano and it is blank..anybody help or know why..


Hi, I ran into the same problem. I had to run “a2ensite xxx.conf” (the conf file you edited). It enables the VirtualHost, and also creates a conf file in the “sites-enabled” directory. After just that, boom, worked.

Great walkthrough. On the final step I was running into a “Invalid command ‘SSLEngine'” error, needed to run “sudo a2enmod ssl” to fix this.