# Unable to get SSL cert issued with Cloudflare proxy

**URL:** <https://community.fly.io/t/unable-to-get-ssl-cert-issued-with-cloudflare-proxy/4997>\
**Category:** Questions / Help\
**Created:** [May 3, 2022, 1:44pm UTC](https://community.fly.io/t/unable-to-get-ssl-cert-issued-with-cloudflare-proxy/4997 "2022-05-03T13:44:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Brewin](https://avatars.discourse-cdn.com/v4/letter/b/b5a626/32.png) [@Brewin](https://community.fly.io/u/Brewin)\
**Post date:** [May 3, 2022, 1:44pm UTC](https://community.fly.io/t/unable-to-get-ssl-cert-issued-with-cloudflare-proxy/4997/1 "2022-05-03T13:44:06Z")

</div>

Hi there,

We noticed that we were unable to get an SSL cert issued when Cloudflare proxies traffic to our [fly.io](http://fly.io) app instance. However, if we turn the proxy off, the cert gets issued successfully. I’m curious to know how this would affect the cert renewal process. Would we have to manually renew certs with Let’s Encrypt?

Thank you for your advice.

---

<div class="post-metadata">

**Author:** ![greg](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/greg/32/2119_2.png) [@greg](https://community.fly.io/u/greg)\
**Post date:** [May 3, 2022, 1:51pm UTC](https://community.fly.io/t/unable-to-get-ssl-cert-issued-with-cloudflare-proxy/4997/2 "2022-05-03T13:51:35Z")

</div>

You are right - using their proxy means the certificate won’t be issued and/or won’t be renewed. Since the DNS returned value will be _Cloudflare’s_, not Fly’s, and so fail the validation. Hence why it _does_ work when the proxy is off (grey cloud). Since then the returned value _is_ Fly’s.

So your choice would either be to turn off the proxy (grey cloud) or if you need their WAF etc and so need to keep it (orange cloud) you would need to add a_nother_ DNS record: the acme challenge. You should be able to get that in the Fly dashboard. As long as _that_ record is _not_ proxied, the certificate should validate and so renew.

---

<div class="post-metadata">

**Author:** ![Brewin](https://avatars.discourse-cdn.com/v4/letter/b/b5a626/32.png) [@Brewin](https://community.fly.io/u/Brewin)\
**Post date:** [May 3, 2022, 3:29pm UTC](https://community.fly.io/t/unable-to-get-ssl-cert-issued-with-cloudflare-proxy/4997/3 "2022-05-03T15:29:05Z")

</div>

Thanks Greg! That’s helpful to know. We’ll try this.

---

<div class="post-metadata">

**Author:** ![ignoramous](https://avatars.discourse-cdn.com/v4/letter/i/a9adbd/32.png) [@ignoramous](https://community.fly.io/u/ignoramous)\
**Post date:** [May 3, 2022, 4:07pm UTC](https://community.fly.io/t/unable-to-get-ssl-cert-issued-with-cloudflare-proxy/4997/4 "2022-05-03T16:07:18Z")

</div>

Read also: [Can I use CloudFlare proxying with Fly certificates ?](https://community.fly.io/t/can-i-use-cloudflare-proxying-with-fly-certificates/1578)