By Greg Nowak. Updated 20 October 2026.
A website can load happily over HTTPS while its server configuration still holds a few unpleasant surprises. The certificate might fail when someone pauses Cloudflare. A renewal might succeed without reaching Nginx. Or the VPS might accept requests that bypass Cloudflare’s protections entirely.
For business owners and agency teams, the useful question is whether the setup will keep working through renewals, incidents and handovers. Here is a practical approach, with implementation details your developer can use.
Use Full (strict), after preparing the origin
Cloudflare sits between the visitor and your VPS, creating two separate connections. For HTTPS visits, Full (strict) encrypts the connection to the origin and checks its certificate. That certificate must be valid, cover the requested or target hostname, and come from a publicly trusted authority or Cloudflare Origin CA. These are Cloudflare’s documented Full (strict) requirements.
Prepare HTTPS on the VPS before changing the mode. Otherwise, certificate validation can fail with a 526 error. If you are changing the setting across a whole zone, check every affected origin first.
Flexible leaves the Cloudflare-to-origin connection on HTTP and can conflict with an origin that redirects to HTTPS. Treat it as a configuration to replace, rather than the finished setup.
Choose the certificate around your recovery plan
Decide whether legitimate traffic must ever reach the VPS directly. That choice matters more than which certificate is quickest to install.
| Your operating requirement | Certificate choice | What to plan |
|---|---|---|
| All website traffic stays behind Cloudflare | Cloudflare Origin CA can fit | Monitor expiry yourself; normal browsers do not trust it directly. |
| Monitoring or a partner needs direct HTTPS | Publicly trusted certificate | Allow the connection deliberately and validate the correct hostname. |
| DNS-only access is an incident fallback | Publicly trusted certificate | Prepare firewall and client-authentication changes as well as DNS. |
| No public request should bypass Cloudflare | Either certificate type | Add origin access controls separately. |
Cloudflare Origin CA certificates are intended for the Cloudflare-to-origin connection. Pausing the proxy exposes an untrusted certificate to ordinary browsers. Cloudflare also currently sends no expiry notifications for these certificates, so even a long validity period needs an owner and an alert.
Install HTTPS without losing the application configuration
Inventory the required hostnames, including the apex domain and www where used. Confirm their DNS destinations and proxy status. Obtain a certificate covering those names, then store the private key outside the web root with restricted access. Keep it out of repositories, tickets and handover documents.
The basic TLS configuration follows the NGINX HTTPS documentation:
server {
listen 443 ssl;
server_name example.com www.example.com;
ssl_certificate /etc/ssl/cloudflare/origin.pem;
ssl_certificate_key /etc/ssl/private/cloudflare-origin.key;
# Application routing belongs here.
}Merge these directives into the appropriate application server block, using your actual certificate paths. For public certificates, supply the required intermediate chain. Then validate before reloading:
sudo nginx -t
sudo systemctl reload nginxRun the reload only if validation succeeds. Test the origin using its intended hostname and a trust configuration appropriate to the certificate. Loading the public site through Cloudflare checks a different connection. Once the origin works, enable Full (strict).
Make certificate renewal an observable process
For a public certificate, use a supported ACME client installation for your operating system. With Certbot and its Nginx plugin installed, these commands remain useful:
sudo certbot --nginx
sudo certbot renew --dry-runThe first command can modify Nginx configuration, so review the result. The dry run tests renewal; also check the scheduled renewal mechanism, deployment or reload step, and the certificate Nginx actually serves.
Let’s Encrypt’s challenge documentation explains the key choice: HTTP-01 starts on public port 80 and cannot issue wildcard certificates. Ensure its challenge requests reach the ACME client through your proxy and access rules. DNS-01 supports wildcards and origins without public web access; automate it with narrowly scoped DNS credentials.
Give redirects a clear owner
Agree where HTTP becomes HTTPS and where the canonical hostname is selected. Cloudflare, Nginx and the application may each contain redirect rules; inspect the combined behaviour before adding another.
Test HTTP and HTTPS on both the apex and www hostnames. Each should reach the intended destination without loops or unnecessary hops, preserving paths and query strings. If direct access is part of recovery, test redirects on that route too.
Redirects do not repair mixed content. Check templates, stored content, scripts, fonts and embeds for HTTP URLs. Then exercise login, forms, checkout, APIs and callbacks. A working homepage tells you little about those flows.
Close the route around Cloudflare
Full (strict) verifies the server’s certificate. It does not prevent direct requests to the VPS IP address.
For a public origin, consider firewall restrictions to Cloudflare’s current IP ranges and Authenticated Origin Pulls, which adds client-certificate authentication. Its global certificate proves traffic comes from Cloudflare’s network; a custom zone-level or per-hostname certificate provides account-specific separation.
Inventory legitimate monitoring and vendor connections before enforcing restrictions. Preserve administrative access, test rejected requests as well as accepted ones, and document recovery. If you use Cloudflare Tunnel instead, plan around its outbound connection model; Authenticated Origin Pulls does not apply to Tunnel traffic.
Leave a handover someone can use
Record the encryption mode, hostnames, certificate locations and expiry, renewal mechanism, redirect rules, origin restrictions and rollback steps. Name the person or team responsible for each ongoing task. Include where alerts go and how to verify the service after a change.
For an agency handover, walk through one renewal check and one recovery scenario together. That usually reveals missing access or assumptions more effectively than another configuration screenshot.
If your Cloudflare and VPS setup has accumulated rules across several migrations, Greg can review the request path, certificate lifecycle and recovery options with your team. Get in touch with Greg to discuss a practical review and a maintainable handover.
Related on GrN.dk
- Shorter TLS Certificates: Will Your Renewal Setup Keep Up?
- Locked Out of Your Apple Developer Account? Fix Access Before October 1
- Nagios HTTPS monitoring: practical checks with check_http and check_curl
Need help with this kind of work?
Ask Greg to review your Cloudflare and VPS setup Get in touch with Greg.
