Using Let's Encrypt with Cloudflare

[linkp]

Welcome to the HestiaCP forum.

@Wonder

I understand that I need to set the A and AAAA records to gray (not proxyed) for it to generate

That understanding is incorrect. I use Let’s Encrypt certificates on my origins with the Cloudflare proxy always enabled. Make sure that you dont have any settings in your Cloudflare config that could disrupt the HTTP-01 challenge, such as Always use HTTPS.

I like to use Config Rules to force requests to the /.well-known/acme-challenge path to use HTTP among a few other settings. You can see a somewhat complete selection here:

Error: Let’s Encrypt finalize bad status 403 - mail domain

I moved away from Page Rules for ACME challenge configs in Cloudflare. I use the Configuration and Cache Rules now. I don’t make any specific WAF changes, only the following: Configuration Rules: Name: ACME Challenge Expression: (starts_with(http.request.uri.path, "/.well-known/acme-challenge/")) Automatic HTTPS Rewrites: Off Browser Integrity Check: Off Opportunistic Encryption: Off Security Level Essentially Off SSL: Off Cache Rules: Name: ACME Challenge Expression: (starts_with(htt…

See if that helps. You should be able to use the native HestiaCP options to obtain Let’s Encrypt certificates once your Cloudflare is set up correctly.

Another option is to use Cloudflare Origin CA certificates, but they are incompatible with direct access, due to only being trusted by the Cloudflare edge. This limits them to use with only proxied HTTPS traffic.