# Use Cloudflare Certs to FlyIO

**URL:** <https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805>\
**Category:** Questions / Help\
**Created:** [January 26, 2022, 8:24am UTC](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805 "2022-01-26T08:24:42Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![ignoramous](https://avatars.discourse-cdn.com/v4/letter/i/a9adbd/32.png) [@ignoramous](https://community.fly.io/u/ignoramous)\
**Post date:** [January 26, 2022, 1:17pm UTC](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805/8 "2022-01-26T13:17:44Z")

</div>

The problem for you is, Fly doesn’t yet support “bring your own certs” with their application load balancer (HTTP/S load balancer). So, it does not matter if you choose to generate certs with (public) _Trusted_ CA / (Cloudflare) _Origin CA_.

Unless there’s an easier way I missed, you have no choice but to terminate TLS in your Fly app using the certs you generate for your domain. How do to ‘terminate TLS’ differs from web-server to web-server. Something like [Caddy has built-in support](https://caddyserver.com/docs/automatic-https), while [Apache requires a bit of configuration](https://httpd.apache.org/docs/2.4/ssl/ssl_howto.html); where as, for reverse proxies like Nginx, HA Proxy there are plenty of tutorials to help you set it up.

Here’s how we do so with Node and Deno:

1. Generate [certs from zerossl.com](https://github.com/acmesh-official/acme.sh/wiki/ZeroSSL.com-CA) or [letsencrypt.org](https://eff-certbot.readthedocs.io/en/stable/using.html) (_Trusted_ CA).
2. Ingest `key` (private) and `crt` (public) files into our [Fly app through `flyctl secrets`](https://community.fly.io/t/how-are-you-managing-cert-files-with-fly/2984/21).
3. Read them during [Node](https://github.com/serverless-dns/serverless-dns/blob/905a98c1a6/src/server-node.js#L61-L73) / [Deno](https://github.com/serverless-dns/serverless-dns/blob/905a98c1a6/src/server-deno.ts#L39) bring-up, and listen for TLS connections, and handle [`TCP`](https://github.com/serverless-dns/serverless-dns/blob/905a98c1a6/src/server-node.js#L286) / [`HTTP`](https://github.com/serverless-dns/serverless-dns/blob/905a98c1a6/src/server-deno.ts#L92) from there, as usual.

We’ve automated steps 1 and 2 behind a github action (gh-action) to run every 2 months, but that isn’t open source because github unfortunately also makes all gh-action ‘runs’ public too, and I haven’t really looked at the logs from previous runs to see if it is safe to make it all public.

---

_[View the full topic](https://community.fly.io/t/use-cloudflare-certs-to-flyio/3805)._