Home Linux Stuff

SYS:ONLINE

Automating Edge Security: Cloudflare Origin Certificates & WAF Protections

Home Linux Staff

3 min read

When hosting web applications behind an edge proxy like Cloudflare, many site owners mistakenly leave their connection in ‘Flexible SSL’ mode—meaning the traffic between the browser and Cloudflare is encrypted, but the traffic between Cloudflare and your server is completely cleartext HTTP.

True end-to-end security requires Strict SSL paired with Cloudflare Origin CA Certificates or automated Let’s Encrypt certificates. Here is the modern best-practice architecture.

⚡ Quick Runbook: 60-Second Implementation

TL;DR: Copy and deploy the baseline production definition directly onto your host:

/etc/ssl/certs/origin.example.com.pem
/etc/ssl/private/origin.example.com.key

1. Why Strict SSL is Essential

Without Strict SSL mode, your origin server is vulnerable to man-in-the-middle attacks between Cloudflare’s edge and your datacenter/VPS. Setting Cloudflare’s SSL mode to Full (Strict) ensures that Cloudflare verifies a valid cryptographic certificate on your origin before proxying requests.

2. Origin CA Certificates (15-Year Rotation)

Instead of renewing Let’s Encrypt certs on the origin every 90 days, Cloudflare provides free Origin CA Certificates signed specifically for your origin server:

  • Valid for up to 15 years.
  • Trusted directly by Cloudflare’s proxy servers (no renewal outages).
  • Restricts direct public access: only Cloudflare proxy requests are accepted.

Save the Origin Certificate and Private Key on your origin server:

/etc/ssl/certs/origin.example.com.pem
/etc/ssl/private/origin.example.com.key

Configure your origin Nginx block:

server {
    listen 443 ssl http2;
    server_name example.com;

    ssl_certificate /etc/ssl/certs/origin.example.com.pem;
    ssl_certificate_key /etc/ssl/private/origin.example.com.key;
    ssl_protocols TLSv1.2 TLSv1.3;

    # Restrict origin connections to Cloudflare IP ranges
    include /etc/nginx/cloudflare_ips.conf;
}

3. Layer 7 WAF & Bot Mitigation

With traffic terminating at Cloudflare:

  • Turnstile Integration: Non-intrusive CAPTCHAs that verify human traffic without frustrating picture puzzles.
  • Rate Limiting: Automatic mitigation against brute-force login attempts on administrative URLs (e.g. /wp-login.php).
  • Zero-Trust Access Policies: Require team email authentication or hardware security keys (FIDO2) before anyone can access administrative backends.

Related Runbooks in This Series

Tags:

← Previous:
Next: →