SSL / HTTPS certificates

🔒 SSL / HTTPS certificates

Get the padlock — via Cloudflare, free auto-renewing Let's Encrypt, or your own certificate

Option	Requires	Why
Cloudflare proxied + Full mode	The domain uses Cloudflare DNS	Works instantly, nothing to do on the server
Cloudflare Origin certificate	An Origin CA Key set in Settings	Lets you run Full (strict) — the safest setup behind Cloudflare
Let's Encrypt	DNS must point straight at `157.254.192.88` (grey cloud / DNS only)	A real, free certificate that renews itself — no Cloudflare needed
Paste your own PEM	You already hold the certificate and private key	Use a certificate bought elsewhere

Make sure the domain resolves straight to 157.254.192.88. On Cloudflare, switch the cloud to grey first.

Open the site → TLS tab → the Let's Encrypt card. An email is optional and only used for expiry reminders.

Click “Issue Let's Encrypt certificate” and wait a moment — the status above updates to the new certificate.

Once issued you can turn the orange cloud back on. Renewal is automatic from then on.

It means Cloudflare is in Full (strict) mode while the origin certificate is still a temporary one. Two ways out:

Fastest — Cloudflare → SSL/TLS → Overview, switch to Full.
Most correct — issue a Cloudflare Origin certificate from the TLS tab and keep strict mode.

⚠️ Avoid Flexible: the hop between Cloudflare and the server is then unencrypted, and WordPress sites usually end up in a redirect loop.

Every chapter