Can I use CloudFlare proxying with Fly certificates?

Questions / Help
1

I have a domain indiepaper.me, I have created a deployment and added A and AAA records to the correct ip addresses. I also created a certificate for the domain in my app, but it was not working so I switched off cloudflare proxy for it to work. Can I turn it back on after the certificate gets issued ?

1 Like
2

Cloudflare allows a few different security settings for its proxy. If you had it set to ā€˜Full (Strict)ā€™, it would expect a valid certificate on the server side. Once itā€™s issued, that mode should work, otherwise you could use ā€˜Fullā€™ which allows untrusted certificates.

3

The certificate we issued for that domain is only good for 3 months, so it will work until it needs to renew. You can do DNS validation following the instructions in our UI to let us renew it even while itā€™s routed through CloudFlare.

You might also be able to create a CNAME record to <app>.fly.dev, assuming CloudFlare will use the <app>.fly.dev hostname/certificate when it connects.

1 Like
4

I couldnā€™t find a way to use that CNAME in Cloudflare, as it looks like it uses the incoming request hostname when connecting to the origin. I know that Fastly does allow overriding the Host header for these situations.

5

I found some info here, but this requires using their load balancer. https://blog.cloudflare.com/per-origin-host-header-override

6

I fixed it the following way,

  • Setup Domain in Cloudflare
  • Setup Fly Ip addresses in Cloudflare
  • Setup Cloudflare as Full SSL Mode
  • Make records pass through only
  • Generate Certificates
  • Turn DNS Proxy back on

Since Fly needs to verify the ip address during certificate issue, I think this would pose a problem when the certificate expires. Is there any way to mitigate this, would setting up that optional CNAME for ACME verification help ?

3 Likes
7

DNS acme validation will work, yes. Weā€™ll keep certs fresh when dns verification is in place.

3 Likes
8

Could you possibly add a flag such as flyctl certs check --without-dns-verification for those who have set up cloudflare to work properly with letsencrypt (i.e. a page rule with /.well-known/* allowed`)?

9

I tried your solution, to add A/AAAA ips with CF Proxy off, to gen certs (for api.mysite.com) then turn back on CF Proxying, but it doesnā€™t work after CF Proxies turn back on.

Trying to use a CName to see what happens, could that work with CF Proxy on? Otherwise looks like I canā€™t use CF and Fly together, need to turn off proxy for A/AAAA addresses.

1 Like
10

I know this is extremely late but did you make sure to set CF SSL mode to ā€œFullā€?

11

Did you ever find a fix? Iā€™m in the same position, even with Universal SSL disabled.

12

Nope, tried everything I found (from the date I posted the above comment) from the fly.io forms. Just gave up and thereā€™s no CF proxy/firewall in front of my fly app.

Just hope no spam bombards it :slight_smile:

13

Did you try re-enabling Universal SSL after verification? I was struggling to get it to work until I did that and then suddenly got green lights.

14

You can authorize certificates through Cloudflare using the acme_challenge CNAME on Flyā€™s certificate page. That CNAME must be unproxied, but it is to hostname provided by Fly.io and doesnā€™t reveal your app.

Cloudflare will default to trying to access your Fly.io origin via HTTP. If you donā€™t allow that, you can set TLS to full, or create a Cloudflare configuration rule that changes the TLS for your Fly.io proxied domain to full or higher.

2 Likes
15

Is the generation of Certificate done on Cloudflare as well as on Fly.io?

16

Hello!

I was unable to get my website to work with a Fly SSL certificate while the CloudFlare proxy was enabled. I tried as many combinations of settings as I could find, but none worked. It seems that Fly SSL is not capable of supporting CDN like Cloudflare.

I figured out how to use the CloudFlare proxy in front of the Fly server anyways. My end goal was to:

  1. Force https with a valid SSL certificate
  2. Allow Cloudflare to proxy the site so you can setup DDOS protection, caching, and redirect rules.

How to Use Fly SSL

I found the only way for Fly SSL certs to work was to disable Cloudflare features:

This gave me a working website with SSL provided by flyctl certs and http->https redirection provided by the Fly server via [http_service] force_https = true.

However, I still needed a way to redirect from *.com to www.*.com for my application to work as expected. And Cloudflare canā€™t perform redirects unless you enable their proxy! So I figured, maybe I can use a SSL certificate generated by Cloudflare instead of Fly.

How to Use Cloudflare SSL

  • Use flyctl certs remove to delete any certificates listed by flyctl certs list.
  • Select Full (Strict) in [SSL/TLS > Overview > Configure > Custom SSL/TLS].
    image
    image1366Ɨ736 41.5 KB
  • Enable universal SSL in [SSL/TLS > Edge Certificates].
    image
  • Enable proxies on all AAAA and CNAME records that link to your Fly app in [DNS > Records].
    image
    image218Ɨ132 2.04 KB
  • Delete any A records in [DNS > Records]; the Cloudflare proxy will provide IPv4 addresses for DNS internally; Fly shared IPs mess up Cloudflare (see Cloudflare 525 error randomly occurs - #45 by morse).

This gets the website live, and working with HTTPS as before. Except now, we can take advantage of our cloudflare proxy! In my case, I made some redirect rules in [Rules > Overview > + Create Rule > Redirect Rule]:

Rule name If incoming requests matchā€¦ Request URL Target URL Status code Place at
http:https Wildcard Pattern http://* https://${1} 301 First
@:www Wildcard Pattern https://example.com* https://www.example.com${1} 301 Last

Now the website works according to my needs.

In conclusion, I think itā€™s best to not use flyctl certs with Cloudflare, if you want to take advantage of Cloudflareā€™s proxy features. Have Cloudflare manage your SSL certs instead.

Edit: Fixes to avoid error 525 when accessing content through Cloudflare (See Cloudflare 525 error randomly occurs).

1 Like
17

I usually avoid making comments for the sake of ā€œthank you,ā€ but dude, seriously, thank you. Iā€™ve been dealing with this issue for three days, and now itā€™s solved, thanks to your findings.

So now Iā€™m:

  • only setting AAAA records in CF
  • removing the IPv4 record in Fly (since CF can seamlessly handle the traffic for clients that donā€™t support IPv4)
  • able to issue the certificates on Fly again
1 Like