# Use Cloudflare Certs to FlyIO **URL:** \ **Category:** Questions / Help\ **Created:** [January 26, 2022, 8:24am UTC](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805 "2022-01-26T08:24:42Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Loonb](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/loonb/32/39805_2.png) [@Loonb](https://community.fly.io/u/Loonb)\ **Post date:** [January 26, 2022, 8:24am UTC](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805/1 "2022-01-26T08:24:42Z")
Is there anyway to set certs if the origin certs was generated via cloudflare? #### Extra explanaiton Maybe the way I say it isn’t clear enough, coz I am new to these Certs things. Here’s what I gonna do: - Cloudflare \> SSL/TLS \> Origin Server \> Create certs (RSA/ECC) - I would like to upload the certs private/public key to [fly.io](http://fly.io) just like how netlify do it with the custom domains. - how? coz i couldn’t find the place to input such things ---
**Author:** ![FrequentFlyer](https://avatars.discourse-cdn.com/v4/letter/f/d26b3c/32.png) [@FrequentFlyer](https://community.fly.io/u/FrequentFlyer)\ **Post date:** [January 26, 2022, 9:17am UTC](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805/2 "2022-01-26T09:17:42Z")
Hello, You could save it in [secrets](https://fly.io/docs/reference/secrets/) and then get it in and out of your app with the necessary code for it. Secrets are made available via `env` variables to the app. There’s likely a size limit for any given secret, in the order of a few kilobyes or so. At least that’s what I remember reading a few days ago. Ref: [How are you managing cert files with Fly?](https://community.fly.io/t/how-are-you-managing-cert-files-with-fly/2984) You could put it into `volumes` as well. Ref: [Where to store CockroachCloud CA certificate? - #2 by jerome](https://community.fly.io/t/where-to-store-cockroachcloud-ca-certificate/2048/2) ---
**Author:** ![ignoramous](https://avatars.discourse-cdn.com/v4/letter/i/a9adbd/32.png) [@ignoramous](https://community.fly.io/u/ignoramous)\ **Post date:** [January 26, 2022, 10:27am UTC](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805/3 "2022-01-26T10:27:31Z")
I don’t think Cloudflare lets you download private keys of the certs they generate to also use it with your other deployments. What Cloudflare lets you do (on Enterprise plans?) is upload your own _public_ (_private_ certs don’t require Enterprise plan, iirc) certs generated elsewhere (with services like [letsencrypt.org](http://letsencrypt.org), [zerossl.com](http://zerossl.com) etc). With Fly, you can use your own certs, but then you’d have to do TLS termination yourself (that is, handle raw `tcp` and `udp`; that is, you won’t be able to use Fly’s HTTP load balancer to front your service). ---
**Author:** ![FrequentFlyer](https://avatars.discourse-cdn.com/v4/letter/f/d26b3c/32.png) [@FrequentFlyer](https://community.fly.io/u/FrequentFlyer)\ **Post date:** [January 26, 2022, 10:54am UTC](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805/4 "2022-01-26T10:54:34Z")
Hey, thanks for making me dig more 😛 Looked around a bit and found that CF allows you to take the private key only when you’re creating them, and not later… as the private key is not stored. [https://developers.cloudflare.com/ssl/origin-configuration/origin-ca#1-create-an-origin-ca-certificate](https://developers.cloudflare.com/ssl/origin-configuration/origin-ca#1-create-an-origin-ca-certificate) Step 10 says: > Copy the signed Origin Certificate and Private Key into separate files. For security reasons, you cannot see the Private Key after you exit this screen. Thread about getting private key out during creation, with an answer from someone at CF: [https://community.cloudflare.com/t/download-origin-cert-dialog-shows-only-cert-no-private-key/11637/2](https://community.cloudflare.com/t/download-origin-cert-dialog-shows-only-cert-no-private-key/11637/2) [https://community.cloudflare.com/t/get-private-key-of-already-existing-origin-certificates/3173/2](https://community.cloudflare.com/t/get-private-key-of-already-existing-origin-certificates/3173/2) ---
**Author:** ![ignoramous](https://avatars.discourse-cdn.com/v4/letter/i/a9adbd/32.png) [@ignoramous](https://community.fly.io/u/ignoramous)\ **Post date:** [January 26, 2022, 11:13am UTC](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805/5 "2022-01-26T11:13:24Z")
“Origin Certs” are not _public_ certs, though, right? Then OP’s question really is (which you answered): “How to use [Fly.io](http://Fly.io) as an origin server with Cloudflare Origin CA”…? which I misunderstood as “How to use same certs as Cloudflare does for my domain proxied through it”. ---
**Author:** ![FrequentFlyer](https://avatars.discourse-cdn.com/v4/letter/f/d26b3c/32.png) [@FrequentFlyer](https://community.fly.io/u/FrequentFlyer)\ **Post date:** [January 26, 2022, 11:50am UTC](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805/6 "2022-01-26T11:50:03Z")
No worries, I could still be wrong. We’ll find out soon anyway. ---
**Author:** ![Loonb](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/loonb/32/39805_2.png) [@Loonb](https://community.fly.io/u/Loonb)\ **Post date:** [January 26, 2022, 12:39pm UTC](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805/7 "2022-01-26T12:39:58Z")
## Your response is faster than my server. 😇 Thanks @FrequentFlyer and @ignoramous First of all, I am not a good server guy. Maybe me myself already misunderstood the whole infrastructure of the cert things. hehe I think what I am looking for is “How to use [Fly.io](http://fly.io/) as an origin server with Cloudflare Origin CA”…? ## My problems Let me put it this way, My domain name is hosted in Cloudflare Registrar, and I use DNS to point to [fly.io](http://fly.io) for custom domain purpose (app in [fly.io](http://fly.io)). Since I would like to use Cloudflare provided SSL, I need to enable the “proxy” for the domain name. (I guess, with proxy enabled, the https will be handled by cloudflare first) when i use cloudflare SSL with the custom domain at [fly.io](http://fly.io), [fly.io](http://fly.io) says the custom domain not `verified` once I **enable** the “proxy” again. fyi, I already added the custom domain to [fly.io](http://fly.io) successfully because previously I **disable** the “proxy”, so [fly.io](http://fly.io) can verify it. ## Expectations ![2022-01-26 20_18_06-Overview _ SSL_TLS](https://global.discourse-cdn.com/fly1/original/3X/9/b/9be899b69193a8067960069187b01f9f4f5a347d.jpeg) I wanna use Full (Strict) SSL cert provided by Cloudflare which requires a trusted CA or Cloudflare Origin CA certificate on the server. Since I wanna use cloudflare provided cert, I think there must be a way for me to input something like secrets or key into [fly.io](http://fly.io). so [fly.io](http://fly.io) (as a webserver) can regconize the https. ## But I totally have no idea how to do it, 50% have no idea how to ask it 😁 # Finally Does this explanation clearer for you? ---
**Author:** ![ignoramous](https://avatars.discourse-cdn.com/v4/letter/i/a9adbd/32.png) [@ignoramous](https://community.fly.io/u/ignoramous)\ **Post date:** [January 26, 2022, 1:17pm UTC](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805/8 "2022-01-26T13:17:44Z")
The problem for you is, Fly doesn’t yet support “bring your own certs” with their application load balancer (HTTP/S load balancer). So, it does not matter if you choose to generate certs with (public) _Trusted_ CA / (Cloudflare) _Origin CA_. Unless there’s an easier way I missed, you have no choice but to terminate TLS in your Fly app using the certs you generate for your domain. How do to ‘terminate TLS’ differs from web-server to web-server. Something like [Caddy has built-in support](https://caddyserver.com/docs/automatic-https), while [Apache requires a bit of configuration](https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html); where as, for reverse proxies like Nginx, HA Proxy there are plenty of tutorials to help you set it up. Here’s how we do so with Node and Deno: 1. Generate [certs from zerossl.com](https://github.com/acmesh-official/acme.sh/wiki/ZeroSSL.com-CA) or [letsencrypt.org](https://eff-certbot.readthedocs.io/en/stable/using.html) (_Trusted_ CA). 2. Ingest `key` (private) and `crt` (public) files into our [Fly app through `flyctl secrets`](https://community.fly.io/t/how-are-you-managing-cert-files-with-fly/2984/21). 3. Read them during [Node](https://github.com/serverless-dns/serverless-dns/blob/905a98c1a6/src/server-node.js#L61-L73) / [Deno](https://github.com/serverless-dns/serverless-dns/blob/905a98c1a6/src/server-deno.ts#L39) bring-up, and listen for TLS connections, and handle [`TCP`](https://github.com/serverless-dns/serverless-dns/blob/905a98c1a6/src/server-node.js#L286) / [`HTTP`](https://github.com/serverless-dns/serverless-dns/blob/905a98c1a6/src/server-deno.ts#L92) from there, as usual. We’ve automated steps 1 and 2 behind a github action (gh-action) to run every 2 months, but that isn’t open source because github unfortunately also makes all gh-action ‘runs’ public too, and I haven’t really looked at the logs from previous runs to see if it is safe to make it all public. ---
**Author:** ![Loonb](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/loonb/32/39805_2.png) [@Loonb](https://community.fly.io/u/Loonb)\ **Post date:** [January 26, 2022, 2:16pm UTC](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805/9 "2022-01-26T14:16:29Z")
Ahh. That’s beyond my skill 😁 . Thanks for the awesome explanation and I think I will stay with [fly.io](http://fly.io) generated Let’s Encrypt cert. # One thing Just curious about SSL things. Let’s say I use cloudflare SSL and flyio’s side couldn’t verify the domain name. In this situation, the connection is still secured? The website is still accessible via https # Finally I need time to digest the “terminate TLS” but thanks a lot!! ---
**Author:** ![ignoramous](https://avatars.discourse-cdn.com/v4/letter/i/a9adbd/32.png) [@ignoramous](https://community.fly.io/u/ignoramous)\ **Post date:** [January 26, 2022, 7:16pm UTC](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805/10 "2022-01-26T19:16:15Z")
> Let’s say I use cloudflare SSL and flyio’s side couldn’t verify the domain name. In this situation, the connection is still secured? The website is still accessible via https The connection between a client and Cloudflare’s reverse proxies is “secure” (over HTTPS). The connection between Cloudflare’s reverse proxies and your origin on Fly wouldn’t be (unless you set up “Origin CA” / “Trusted CA”). Btw, the Cloudflare documentation is pretty well written: [Encryption modes · Cloudflare SSL/TLS docs](https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes#flexible) ---
**Author:** ![FrequentFlyer](https://avatars.discourse-cdn.com/v4/letter/f/d26b3c/32.png) [@FrequentFlyer](https://community.fly.io/u/FrequentFlyer)\ **Post date:** [January 27, 2022, 2:51am UTC](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805/11 "2022-01-27T02:51:33Z")
@Loonb This should help: > [@Cloudflare 525 error randomly occurs](https://community.fly.io/t/cloudflare-525-error-randomly-occurs/1798/19): > > I got it running, thanks everyone for your help. These are the exact steps I took: 1 Add your domain to Cloudflare CF will not give an origin cert for a domain that they do not control. You won’t be able to do this for your Fly dev domain (eg: your-app.fly.dev). Add the domain to CF, change the NS in your registrar’s dashboard, and wait until the NS have propagated. 2 Configure the DNS to point to your Fly app You will need to add A records so that your domain or subdomain point to your Fly a… ---
**Author:** ![Loonb](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/loonb/32/39805_2.png) [@Loonb](https://community.fly.io/u/Loonb)\ **Post date:** [January 27, 2022, 6:00am UTC](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805/12 "2022-01-27T06:00:22Z")
I see, now i get the whole view. Thanks 💝 ---
**Author:** ![Loonb](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/loonb/32/39805_2.png) [@Loonb](https://community.fly.io/u/Loonb)\ **Post date:** [January 27, 2022, 6:01am UTC](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805/13 "2022-01-27T06:01:40Z")
Thanks. You should change your name to FrequentSolver. 🤩 ---
**Author:** ![FrequentFlyer](https://avatars.discourse-cdn.com/v4/letter/f/d26b3c/32.png) [@FrequentFlyer](https://community.fly.io/u/FrequentFlyer)\ **Post date:** [January 27, 2022, 12:58pm UTC](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805/14 "2022-01-27T12:58:35Z")
Hah, not at all. Thanks to @ignoramous, @pier, and others in general who have tried the same thing before and shared their lessons learnt. I’m just a concierge.