CloudFlare SSL

Michal

Hello,

Im struggling with SSL certification, when server is behind Cloudflare proxi.

During installation I choose LetsEncrypt certificate, but it is not generated, because it is via http challenge. Is it possible to solve it via selfsigned and then have a certificate on the Cloudflare side? But how to solve access from the local network, Where is the ITflow application and station with the fact that DNS must point to the local IP and not via the outside (cloudflare)

Another solution is to have DNS challenge with API token?

How do you have ITflow set up via CloudFlare?

wrongecho

I think the installation script will complete without the SSL working, and then you can manually edit Apache to include the Cloudflare self signed SSL instead?

Michal

yes, the installation was successful.

But if I wanted the certificate to be trusted by browsers from the local network, I know I can manually install it on the stations, but I don't really like that.

So I'm looking for a solution and I think it could be using DNS challenge and CF plugin on the server side. But I don't have much experience with Apache, SSL and especially with CF.

So if anyone has a working solution and would know how to set it up?

wrongecho

Point all clients - local or otherwise - to go via the Cloudflare proxy and you won't get SSL errors?

Michal

It is true that the dns does not point directly to the public IP of my server, so there would be no loopback. So I do not have to set up an A record on the local DNS to the local IP.

So during installation jsut HTTPS with a Selfsigned certificate and set full mode in CF

wrongecho

Michal

Yes do that and it should let clients access with https, but it likely won't fix the installation script.

Michal

wrongecho

If you choose self signed certificate installation script is ok. It seems like everything is working.

thanks for help.

wrongecho

Happy to help!

For security, you should configure your server's firewall to only accept http/s connections from Cloudflare - that way they can't bypass the WAF features just by knowing the server IP.

Edit: Forgot to mention, you need to edit config.php and add the following, or your logs will show the Cloudflare IP and not your user IPs (docs):
DEFINE('CONST_GET_IP_METHOD', 'HTTP_CF_CONNECTING_IP');

Michal

wrongecho

thanks that's good point to make firewall rules for incoming traffic

Bigbug

Michal best way to go is completely blocking all incoming traffic and using cloudflare tunnels to expose your ITFlow

jtmoore81

Bigbug

This is what I do and it works great.

litechforce

Another thing you can do is get your own cert via certbot using a dns challenge plugin.

Michal

yes, I solved it using a self signed certificate and dns challenge is also possible.

Maybe it would be worth writing a guide for others who don't work with CF