The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
You can use a Cloudflare Origin CA certificate with Apache on Ubuntu to encrypt the connection between Cloudflare and your server. Install the certificate and private key in Apache, make sure the certificate covers the hostnames your site serves, then set Cloudflare’s encryption mode to Full (strict). This certificate is not trusted by browsers for direct connections to your server; visitors should reach the site through Cloudflare’s proxy, or you should use a publicly trusted certificate for direct access.
What does a Cloudflare Origin Certificate secure?
A Cloudflare Origin CA certificate secures the connection from Cloudflare to your origin server. It lets Cloudflare verify the certificate presented by Apache when it connects to your server, but it does not make the certificate trusted by browsers. Cloudflare describes these certificates as encrypting traffic between Cloudflare and the origin, not between client browsers and the origin.
As an Amazon Associate I earn from qualifying purchases.
That trust boundary determines when this setup is appropriate. If the hostname is proxied through Cloudflare, the visitor’s browser connects to Cloudflare and Cloudflare connects securely to Apache. If a visitor connects directly to the origin IP, or you turn off proxying for the hostname, a browser may show NET::ERR_CERT_AUTHORITY_INVALID. That warning does not by itself mean the certificate failed between Cloudflare and Apache; it means the browser does not trust Cloudflare Origin CA for a direct connection.
Cloudflare says Origin CA certificates are compatible with Strict SSL mode once deployed. The safer end state is Full (strict), which requires a valid certificate at the origin rather than merely an encrypted connection. Do not use an Origin CA certificate as the only certificate if people or other clients must connect directly to the server and validate it with their usual public trust stores.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
What should you check before creating the certificate?
Decide which hostnames the Apache virtual host will serve before issuing the certificate. The certificate must cover the exact requested hostname, and DNS records for names relying on Origin CA should be proxied through Cloudflare.
Plan hostname coverage
- List the apex domain, such as
example.com, and any names such aswww.example.comorshop.example.comthat Apache must serve. - Cloudflare supports up to 200 individual Subject Alternative Names (SANs) on an Origin CA certificate, according to its documentation last updated August 14, 2026.
- Wildcard coverage is limited to one level. A wildcard for
*.example.comcovers a first-level name such aswww.example.com, not a deeper name such asstore.eu.example.com. Include deeper hostnames individually if they need coverage. - IP addresses cannot be used as SANs. If clients need to validate a direct connection by IP address, an Origin CA certificate does not provide that coverage.
Check access and plan your key handling
You need access to the Cloudflare account’s Origin Server certificate controls and permission to change Apache configuration on the Ubuntu host. Cloudflare requires account or member API access to create or revoke Origin CA certificates. For API automation, the token needs the Zone - SSL and Certificates - Edit permission.
Cloudflare offers to generate RSA or ECC key material, or you can provide your own certificate signing request (CSR). Whichever route you choose, prepare a protected place to save the certificate and private key separately. Cloudflare does not show the private key again after you leave the certificate creation screen, so losing the key means you cannot retrieve that same private key from the creation page.
How do you create the Origin CA certificate?
Create the certificate in Cloudflare, choose PEM output for Apache, and save both returned files before leaving the creation screen. PEM is the normal choice for Apache and OpenSSL deployments.
- In Cloudflare, open SSL/TLS → Origin Server → Origin Certificates → Create Certificate.
- Choose Cloudflare-generated RSA or ECC key material, or provide your own CSR.
- Enter every hostname Apache needs to serve, including the apex,
www, and any other required subdomains. Check that any wildcard is only being used for one hostname level. - Select a validity period and choose PEM as the format.
- Copy the signed Origin Certificate and Private Key into separate protected files immediately. Keep the private key confidential and do not put it in a public web directory or commit it to source control.
Cloudflare says servers using OpenSSL, including Apache, generally expect PEM files, which are Base64-encoded ASCII; it also says binary DER files can work. For the Apache instructions below, the paths and directives assume you saved PEM certificate and key files.
Where should you store the certificate and private key?
Use separate files in protected system locations, and ensure Apache can read the private key when the service starts. Ubuntu’s conventional locations include /etc/ssl/certs for certificates and /etc/ssl/private for private keys.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
/etc/ssl/certs/cloudflare-origin.pem
/etc/ssl/private/cloudflare-origin.keyPlace the certificate at the first path and the private key at the second, or update the Apache directives later if you use different filenames. Keep backups protected to the same standard as the live key. Do not loosen permissions broadly just to make Apache start; identify the account and access requirements for your Apache deployment instead.
Some Apache deployments require the Cloudflare Origin CA root chain. If yours does, obtain the matching RSA or ECC Origin CA PEM root and configure the chain in the manner supported by that Apache build. Do not add a chain file by guesswork: a mismatched or unnecessary chain configuration can make troubleshooting harder. If Cloudflare reports that the issuer or chain cannot be found, check whether the appropriate root chain is required.
How do you configure HTTPS in Apache on Ubuntu?
Enable Apache’s SSL module and an HTTPS site, then configure the port 443 virtual host to present the Origin Certificate and its matching private key. For a simple Ubuntu setup using the packaged default SSL site, run:
sudo a2enmod ssl
sudo a2ensite default-ssl
sudo systemctl restart apache2.serviceFor a named site, edit its existing Apache configuration instead of relying on the default SSL virtual host. The file location depends on how that site was installed; use the configuration enabled for the site and make the changes in its <VirtualHost *:443> block.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Set the hostname and certificate directives
Set ServerName to the primary hostname and add any required ServerAlias values. Point the certificate and key directives to the files you installed:
<VirtualHost *:443>
ServerName example.com
ServerAlias www.example.com
SSLEngine on
SSLCertificateFile /etc/ssl/certs/cloudflare-origin.pem
SSLCertificateKeyFile /etc/ssl/private/cloudflare-origin.key
# Add a Cloudflare chain directive only if your Apache build requires it.
</VirtualHost>Replace the example hostnames with the names on your certificate and the names this virtual host actually serves. If you stored the files elsewhere, change the directive paths to match. Ubuntu’s Apache documentation identifies mod_ssl as the module that adds encrypted communications and notes that certificate and key directives need updating when files are outside the default locations.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Test before reloading
Check the Apache configuration before applying it. A syntax error, wrong file path, inaccessible private key, or key passphrase issue can prevent Apache from starting.
sudo apache2ctl configtestContinue only when the configuration test reports that the syntax is okay. Then reload or restart Apache, for example:
Recommended Free Tools
sudo systemctl reload apache2.serviceIf the reload fails or the service does not start, inspect the service error and Apache configuration before changing Cloudflare’s encryption mode. Ubuntu notes that a passphrase may be required depending on how the certificate was obtained. Also confirm that TCP port 443 is permitted by the host firewall and any cloud security group. A correct certificate configuration cannot serve HTTPS if traffic cannot reach the origin on that port.
When should you set Cloudflare to Full (strict)?
Set the mode after Apache is presenting the intended certificate on port 443. In Cloudflare, open SSL/TLS → Overview and choose Full (strict) when every relevant origin host has a Cloudflare Origin CA certificate or a publicly trusted certificate.
Cloudflare’s deployment sequence is to install the certificate, update the origin web-server configuration, install the root chain where required, enable SSL and port 443, and then change the Cloudflare mode. The order matters: switching to strict validation before the origin serves a valid certificate for the requested hostname can cause Cloudflare-origin failures.
If your setup includes multiple origin hosts, check them all before selecting strict mode. A certificate on one Apache server does not fix another hostname routed to a different origin with an expired, mismatched, or otherwise invalid certificate. Full (strict) is appropriate only when all of those relevant origins meet the certificate requirement.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
How can you verify the certificate and trust path?
Test the hostname through its proxied Cloudflare DNS record, then check the origin configuration if the request fails. A browser result through the proxy and a direct-to-origin browser result test different trust paths, so do not treat them as interchangeable.
- Confirm proxying: The DNS record for the hostname should be proxied if the site relies on Origin CA and is expected to be visited through Cloudflare.
- Confirm hostname coverage: Check the certificate SAN list against the exact hostname in the request, including whether a wildcard actually covers that hostname level.
- Confirm validity: Check that the certificate has not expired.
- Confirm Apache’s virtual host: Ensure the port 443 virtual host selected for the requested hostname points to the intended certificate and key.
- Confirm the chain if needed: If Cloudflare cannot build or find the issuer chain, check whether the matching Cloudflare Origin CA RSA or ECC root PEM is required by the deployment.
- Confirm network reachability: Verify that port 443 is open at the host firewall and any cloud security-group layer.
A successful Apache restart only proves that Apache accepted its configuration; it does not prove that Cloudflare is reaching the expected origin, that the SAN matches, or that the complete trust chain is available.
What do common Cloudflare Origin Certificate errors mean?
Use the symptom to identify which side of the connection is failing. In particular, an authority error in a browser accessing the origin directly is different from a strict-mode validation failure between Cloudflare and Apache.
| Symptom | Likely cause | What to do |
|---|---|---|
Browser shows NET::ERR_CERT_AUTHORITY_INVALID after bypassing Cloudflare |
The browser does not trust Origin CA for direct client-to-origin traffic. | Restore proxying for the hostname, or install a publicly trusted certificate if direct browser access is required. |
| Cloudflare reports an issuer or chain problem | The origin deployment may require the Cloudflare Origin CA root chain. | Check whether the matching RSA or ECC PEM root is needed and configure the chain as supported by your Apache build. |
| Full (strict) fails | The certificate may be expired, may not cover the requested hostname, or Apache may present a different certificate than intended. | Inspect the SANs, validity, port 443 virtual host, and served chain before changing the encryption mode. |
| Apache fails to start after SSL changes | Possible syntax error, wrong certificate or key path, file-permission problem, or passphrase issue. | Run sudo apache2ctl configtest, fix the reported issue, verify file access and any required passphrase, then restart or reload. |
| Certificate creation or revocation is denied | The Cloudflare user or API token lacks the required access. | Check account or member API access; API automation requires Zone - SSL and Certificates - Edit. |
Cloudflare’s Origin CA troubleshooting documentation was last updated June 8, 2026. The distinction between browser trust and Cloudflare-origin validation remains the first check when interpreting an error: direct-browser trust cannot be repaired simply by switching Cloudflare to Full (strict).
Free tools Windows power users keep installed
One-click scans. No signup required.
How should you handle renewal, automation, and revocation?
Track the certificate’s expiry independently and schedule replacement before it lapses. Cloudflare currently does not send expiration notifications for Origin CA certificates, so the absence of a reminder is not evidence that the certificate is still valid.
Plan a renewal window
- Record the certificate’s hostname coverage, issuance details, and expiry date in an inventory or monitoring system.
- Set an alert far enough ahead of expiry to obtain and install a replacement without rushing.
- Issue the replacement and securely save its private key and certificate.
- Install the new files, update Apache’s paths if necessary, run the configuration test, and reload or restart Apache.
- Check the hostname through Cloudflare after the change and confirm the origin is still valid under Full (strict).
Cloudflare supports API operations to list, create, retrieve, and revoke Origin CA certificates. If you automate those operations, use a token with the required Zone - SSL and Certificates - Edit permission and protect the token as a credential.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Revoke only with a replacement plan
Revocation is irreversible. If a private key is lost or a certificate must no longer be trusted, plan the replacement and account for any temporary effect on Cloudflare’s encryption-mode requirements before revoking. Do not revoke a working certificate first and assume that Apache or Cloudflare will substitute another one automatically.
Should you use Cloudflare Origin CA or a public certificate?
Choose based on who must trust the certificate and how the origin will be reached. Cloudflare Origin CA is suited to an origin whose traffic is expected to pass through Cloudflare; a publicly trusted certificate is the better fit when clients need to connect directly and validate the origin certificate in a browser or ordinary public trust store.
| Consideration | Cloudflare Origin CA | Publicly trusted certificate |
|---|---|---|
| Trust audience | Cloudflare-to-origin trust; not browser trust for direct connections. | Intended for direct client trust through public certificate authorities. |
| Issuance path | Issued through Cloudflare Origin Server controls, or based on a supplied CSR. | Issued through the selected public CA’s process. |
| Hostname coverage | Up to 200 individual SANs; one-level wildcards; no IP-address SANs. | Coverage depends on the selected public CA and certificate. |
| Expiry operations | Cloudflare does not currently send Origin CA expiration notifications; monitor expiry yourself. | Renewal and monitoring depend on the selected CA and your deployment. |
| Proxying disabled or direct access | A browser may report an authority error because it does not trust Origin CA. | Can support direct browser trust when the certificate is valid, correctly configured, and covers the hostname. |
The trade-off is not simply convenience versus security. Origin CA can provide the origin-side certificate Cloudflare needs for strict validation, but it relies on the Cloudflare trust boundary. A public certificate may be necessary where direct access matters, and its renewal process depends on the CA and deployment you select.
Frequently Asked Questions
Can I recover the private key if I closed the Cloudflare certificate screen?
No. Cloudflare does not display the private key again after you leave the creation screen. If you did not save it, create a replacement certificate and install the new certificate-and-key pair.
Can one Cloudflare Origin Certificate cover several websites?
It can cover multiple hostnames when they are included as SANs, up to Cloudflare’s stated limit of 200 individual SANs. Each Apache virtual host still needs to serve the matching certificate for the hostname being requested.
Can I use an Origin CA certificate for a server accessed by its IP address?
Cloudflare Origin CA certificates do not support IP-address SANs. Use a hostname covered by the certificate, or choose a certificate and access design that supports the direct IP use case.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Does Cloudflare automatically renew an Origin CA certificate?
Cloudflare documents API operations for managing certificates, but it does not currently send expiration notifications. Treat renewal as an operational task: track expiry and arrange replacement before the certificate expires.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
