Skip to main content
Cloudflare Origin CA certificates encrypt traffic between Cloudflare and Readdy. Use this guide when the Cloudflare Proxy section appears on your Domain Settings page.
The Cloudflare Proxy section only appears when Readdy detects that your domain’s authoritative DNS provider is Cloudflare. Your domain can be registered with any registrar.

​
Before You Start

Make sure that:
  • Your custom domain has been added to Domain Settings in Readdy.
  • Your domain is active in your Cloudflare account.
  • You have permission to manage SSL/TLS settings and create Origin CA certificates in Cloudflare.
  • You have noted every hostname shown in Readdy, such as example.com and www.example.com. The certificate you create must cover all of them.
Keep the Cloudflare and Readdy tabs open while you complete the setup.
If Readdy is still verifying your DNS records, keep the required website records set to DNS only until verification succeeds. Complete the verification before enabling Cloudflare Proxy.

​
Get and Add an Origin CA Certificate

1

Open the Origin Server Page

  1. Sign in to the Cloudflare dashboard.
  2. Select the domain you added to Readdy.
  3. Go to SSL/TLS > Origin Server.
  4. Under Origin Certificates, click “Create Certificate”.
You can also open Cloudflare’s Origin Server page directly and select your domain.
2

Create an Origin CA Certificate

Choose “Generate private key and CSR with Cloudflare”, then confirm the default settings:
  • Keep the default RSA (2048) private key type unless your organization requires a different type.
  • Under Hostnames, Cloudflare automatically includes your root domain, such as example.com, and its wildcard domain, *.example.com. In most cases, you do not need to change these entries.
  • The wildcard covers first-level subdomains such as www.example.com and app.example.com. Only add another hostname if Readdy displays a domain that is not covered, such as one.two.example.com.
  • Keep the default 15 years certificate validity unless your organization’s security policy requires a shorter period.
Cloudflare Origin CA certificate form with RSA 2048, root and wildcard hostnames, and 15-year validity selected

Keep the default key type, hostnames, and 15-year validity unless your organization requires different settings

Click “Create”.
3

Copy the Certificate and Private Key

Select PEM as the key format. Cloudflare displays two values:
  • Origin Certificate, beginning with -----BEGIN CERTIFICATE-----
  • Private Key, beginning with -----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY-----
Copy each value in full, including the BEGIN and END lines.
Cloudflare Origin Certificate Installation page with PEM selected and the Origin Certificate ready to copy

Select PEM, then copy the Origin Certificate and Private Key separately

Cloudflare shows the private key only once. Store it securely before leaving the page. Never share it in a support ticket, email, chat, screenshot, or application log. If you lose it, create a new certificate and replace the old one in Readdy.
4

Choose the SSL/TLS Scope

Before adding the certificate to Readdy, configure Cloudflare to use strict certificate validation for the Readdy hostnames. Keep the Readdy website records set to DNS only during this step.First, check whether other proxied hostnames in the same Cloudflare zone use different origin servers.
Do not change the zone-wide mode until you have checked every proxied origin. Enabling Full (strict) for an origin without a valid, unexpired certificate that matches its hostname can cause an Error 526.
Choose one of the following options:
  1. Apply Full (strict) to the entire zone: Use this option only when every proxied hostname in the zone points to an origin with a valid certificate. Go to SSL/TLS > Overview, set SSL/TLS encryption mode to Full (strict), then click “Save”.
  2. Apply Strict only to Readdy hostnames: Use this option when the zone contains other origins or when you are unsure about their certificates. Keep the current zone-wide mode, then create a Cloudflare Configuration Rule that matches each Readdy hostname and sets SSL to Strict.
Cloudflare SSL TLS Overview page with Full Strict encryption mode selected

Set the zone-wide encryption mode to Full (strict) only after checking every proxied origin

5

Add the Certificate to Readdy

  1. Return to Domain Settings in Readdy.
  2. In the Cloudflare Proxy section, turn on the switch.
  3. Confirm that the domains shown in the modal are covered by your certificate.
  4. Paste the complete Origin Certificate into Origin Certificate.
  5. Paste the matching private key into Private Key.
  6. Select “I have set Cloudflare SSL/TLS mode to Full (strict)”.
  7. Click “Save and enable”.
Readdy Configure Cloudflare Proxy dialog with certificate and private key fields

Paste the matching certificate and private key, then confirm Full (strict) mode

Readdy validates the certificate format, private key, expiration date, and hostname coverage before enabling Cloudflare Proxy.Do not continue until Readdy displays Enabled and confirms that the Origin CA certificate is valid. If either status is missing, keep the Readdy website records set to DNS only and resolve the validation issue first.
6

Enable Proxying for the Readdy DNS Records

Go to DNS > Records, then change the required Readdy website records to Proxied, shown as an orange cloud.
Cloudflare DNS records page with the Readdy domain set to Proxied

Confirm that each required Readdy website record shows Proxied

Cloudflare Origin CA certificates are trusted by Cloudflare, not by web browsers. Visitors may see certificate errors if you pause Cloudflare or switch a proxied record to DNS only while Readdy is using the Origin CA certificate.
7

Verify the Configuration

Confirm each part of the setup:
  1. In Readdy, the Cloudflare Proxy section displays Enabled and shows that the Origin CA certificate is valid.
  2. In Cloudflare, each required Readdy website record displays Proxied.
  3. Open every configured hostname, including the root domain and any configured subdomains such as www, and confirm that each page loads over HTTPS without an Error 526.
Readdy Domain Settings page with Cloudflare Proxy enabled

Readdy displays Enabled after the Origin CA certificate is validated

You can now publish your website. Cloudflare caching may delay when the latest version appears to visitors.

​
Troubleshooting

Symptom: The Cloudflare Proxy section does not appear in Readdy.Cause: Readdy has not detected Cloudflare as the domain’s authoritative DNS provider.How to fix: Confirm that the domain uses the Cloudflare nameservers assigned to your zone. Then wait for DNS propagation and refresh Domain Settings.
Symptom: Readdy reports that one or more domains are not covered by the certificate.Cause: The certificate does not cover every hostname shown in the Readdy modal.How to fix: Create a new Origin CA certificate that covers every hostname shown in Readdy. For a root domain and first-level subdomains, keep Cloudflare’s default root and wildcard entries.
Symptom: Readdy cannot validate the certificate and private key pair.Cause: The values may come from different certificate creation sessions or may be incomplete.How to fix: Copy both values again without removing the BEGIN or END lines. If the private key is no longer available, create a new certificate. The certificate and key must come from the same Cloudflare certificate creation session.
Symptom: Readdy reports that it cannot read the certificate.Cause: The certificate may be incomplete or use an unsupported format.How to fix: Select PEM in Cloudflare and paste the complete certificate value. Do not paste a PKCS#7 (.p7b) file or the Cloudflare Origin CA root certificate.
Symptom: Cloudflare displays an error when you create an Origin CA certificate.Cause: Your account may not have API Access or permission to manage SSL/TLS settings.How to fix: Ask the Cloudflare account owner to update your permissions or create the certificate for you.
Symptom: Visitors see a certificate error when they open your website.Cause: The website may be connecting directly to the Readdy origin instead of through Cloudflare.How to fix: Confirm that the required website DNS record is Proxied and that Cloudflare’s SSL/TLS encryption mode is Full (strict). Cloudflare Origin CA certificates are not designed for direct browser-to-origin connections.
Symptom: The website displays an Error 526 after you change the SSL/TLS mode to Full (strict).Cause: Cloudflare cannot validate the certificate served by the origin. The certificate may not be active in Readdy, may be expired, or may not cover the requested hostname. If the error affects another hostname in the same zone, that hostname may use a different origin without a valid certificate.How to fix:
  1. Confirm that Readdy shows Cloudflare Proxy as Enabled and the Origin CA certificate as valid.
  2. Confirm that the certificate covers the affected hostname and has not expired.
  3. If only another hostname in the zone is affected, install a valid certificate on that origin or use a Configuration Rule to apply Strict only to the Readdy hostnames.
Read Cloudflare’s Error 526 troubleshooting guide for more details.
Read the Cloudflare Origin CA documentation for more information about certificate creation, supported hostnames, and security requirements.
Never include your private key in a support request.

​
Need Help?

If this guide doesn’t resolve your issue, submit a support ticket. We’re here to help!