When using CloudFlare, there are very high chances that the automatic installation and renewal of our free SSL Certificate will fail. Even the manual installation using the steps listed here may fail. This is an expected behavior and there is no need to panic.
In a recent article, we shared reasons why the free SSL Certificate may fail to install or renew. One of the causes was the domain not directly pointing to our servers. And this is exactly what happens with CloudFlare.
It's worthy to remember that when using CloudFlare, you will most of the time be required to use CloudFlare nameservers. This means pointing the domain name away from our network. Because of this, http-based domain validation may fail.
E-mail-based validation would be possible even when a domain is pointing to CloudFlare. However, the free SSL Certificate doesn't support this type of domain ownership validation.
The absence of a possible domain validation mechanism makes it hard for the certificate authority to issue the SSL certificate. Thus, the SSL installation will not happen. This leaves us with two possible solutions.
1. Buy and Install a Premium SSL Certificate
CloudFlare and an SSL Certificate are both worthy having. CloudFlare is critical in improving your website performance and preventing some forms of cyber attacks such as denial of service (DoS) attacks. Yet SSL is also critical for maintaining an encrypted communication between the web server hosting your website and the device accessing your website. Therefore, we highly recommend maintaining both cloudFlare and the SSL Certificate.
Now, in a situation where you need to maintain cloudFlare but the free SSL certificate cannot be issued, the only remaining option is investing some small bucks in a premium SSL certificate. You can use email-based validation to validate ownership of the domain and have the SSL certificate issued.
The good news is that premium SSL certificates have increasingly become very cheap. For less than ten dollars for example, you get obtain a single domain DV certificate from Jubilee Hosting Services. And moreover, these offer stronger encryption compared to the free SSL certificates. I will discuss the detailed benefits of a premium SSL certificate in another article.
2. Revert to Our Default Nameservers
If you are hosting with us and are ready to forego the benefits of cloudFlare in exchange for the free SSL certificate (which I wouldn't recommend by the way), then the solution would be switching back to our default nameservers. We have listed those nameservers here for both shared and reseller hosting clients.
