Cloudflare Origin Certificate not working

[syedalijan]

Hello,

I have been trying to import Cloudflare Origin Certificate on my Hestia Panel, but failed everytime. When saving the origin certificate (SSL Certificate and Key Value) disappears when saved.

I have uploaded the Cloudflare certificate authority file on server by using following cmds.

wget https://developers.cloudflare.com/ssl/static/origin_ca_rsa_root.pem
mv origin_ca_rsa_root.pem origin_ca_rsa_root.crt
cp origin_ca_rsa_root.crt /usr/local/share/ca-certificates
update-ca-certificates

Can anyone help?

[syedalijan]

This is the cert and key I am uploading, tried this on domain SSL as well, it imports fine but I am still getting LetsEncrypt E1 certificate instead of Cloudflare.

[falzo]

there are a few informations missing about what exactly you want to achieve and what you have setup so far.

you want to use your CF cert for the domain that is also your hostname and under which hestia itself is running?
you have that domain/hostname setup as a domain under the admin account as usual?

the first screen you posted seems indeed like the one to add the cert for hestia itself. not sure why it does not save it there to be honest, but as you already tried a workaround could be to add it to the domain itself in your admin account/web domain.
however after you did this you still need to tell hestia to pick it up for itself. you can do this from the console via the v-update-host-certificate command.

after that it should copy the cert from your web-domain to the hestia nginx and run it properly.

[punkyard]

hi
i’ve got the exact same problem
i’ve got a crashtest ubuntu 20.04 server (freshly installed … and often reinstalled …!) to try hestia v164 in different ways (i’m no IT) in which i kept the panel domain in the admin (though you told me it’s better in a user account, but it’s just for testing here)

i have CF cerf origin copied & pasted in HESTIA configuration menu, but when I save, it disappears. but that’s not all folk’s:

: hestia’s domain end up with a let’s encrypt cerf and i don’t get any error visiting the domain with different browsers at panel.domain.org:2083 but none would display panel.domain.org …
(it’s said that :8083 is not accepted by cloudflare, in confirm)

in WEB section in HESTIA
SSL is not even activated on the domain panel.domain.org

I’d truly be happy to understand my situation if one can help
cause it’s giving me a very hard time trying to understand what to do to have a simple and clean server working with hestia and cloudflare. i get gateaways, 403s, https not secured even with a cerf in hestia, younameit, well… all sorts of messages grinding my peace of mind ^^

I’ve read people have nice servers running with hestia, nextcoud … so far … i’m not there … yet - but i can’t understand why, cause i’m following the exact simple steps of different tutorials, documentation files, …

now, i want to ask you @falzo, what you mean by:

however after you did this you still need to tell hestia to pick it up for itself. you can do this from the console via the v-update-host-certificate command.

pick it up? copy paste is not enough?
v-update-host-certificate command would do what?

nothing in hestia’s doc, see …

where are the cerfs in the server by the way?

thanks at all responders

[alec]

AFAIK it’s normal for the value in the <textarea> to disappear on save - it does for me and still works.

This video guide works reliably for me (I followed it today) and includes origin certificate setup:

HestiaCP with Cloudflare - Web and Email setup on Oracle Cloud

[punkyard]

thanks @alec I used it too
i realize now that even this cloudflare it can take up to 10 min or more for the dns and certificate to work together

[falzo]

is your problem solved?

what I meant or do is adding the domain you want to use as panel domain to the admin account (is it’s the hostname, it’s usually already there).
and then add your certificate to that domain (could be one acquired externally or just using letsencrypt there).
once you have that done, you can run v-update-host-certificate admin <yourpaneldomain> on cli to make hestia use this certificate for it’s own instance.

in the end, that should result in avoiding proxy/gateway errors… but of course there are other ways to help with that, like adding the cert directly, like it seems, this now hopefully worked for you too

[punkyard]

i’m waiting to see how long it’s going to last ^^ yes, the panel website is ok now ! i’ve changed the port 8083 to make it compatible with CLOUDFLARE
so i guess my question in answered
thank you all for your assistance

@falzo, though, i’ve created a simple user to manage the hestiapanel.domain.com - as understood earlier, that it was better for security reasons
i haven’t needed the v-update-host-certificate admin command to make it work though …

[punkyard]

would it be possible to make the IP address secured by a ssl?

[eris]

No not really.

[punkyard]

it’s not technically possible?

[punkyard]

@falzo

v-update-host-certificate admin mypaneldomain.com

returned: sudo: v-update-host-certificate: command not found

have i used it the wrong way?

[jlguerrero]

Try $HESTIA/bin/v-update-host-certificate …

[punkyard]

thanks

$ sudo /usr/local/hestia/bin/v-update-host-certificate user hpanel.domain.net

[Prof.Sohail]

Just a tip: after pasting certificate and key, press enter key.

[vinod]

This can be resolved by changing your SSL/TLS encryption mode to Full (strict) from cloudflare site.