> ## Documentation Index
> Fetch the complete documentation index at: https://docs.readdy.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Get a Cloudflare Origin CA Certificate

> Create a Cloudflare Origin CA certificate and use it to enable Cloudflare Proxy for your Readdy custom domain

Cloudflare Origin CA certificates encrypt traffic between Cloudflare and Readdy. Use this guide when the **Cloudflare Proxy** section appears on your **Domain Settings** page.

<Info>
  The **Cloudflare Proxy** section only appears when Readdy detects that your domain's authoritative DNS provider is Cloudflare. Your domain can be registered with any registrar.
</Info>

## Before You Start

Make sure that:

* Your custom domain has been added to **Domain Settings** in Readdy.
* Your domain is active in your Cloudflare account.
* You have permission to manage SSL/TLS settings and create Origin CA certificates in Cloudflare.
* You have noted every hostname shown in Readdy, such as `example.com` and `www.example.com`. The certificate you create must cover all of them.

Keep the Cloudflare and Readdy tabs open while you complete the setup.

<Info>
  If Readdy is still verifying your DNS records, keep the required website records set to **DNS only** until verification succeeds. Complete the verification before enabling Cloudflare Proxy.
</Info>

## Get and Add an Origin CA Certificate

<Steps>
  <Step title="Open the Origin Server Page">
    1. Sign in to the [Cloudflare dashboard](https://dash.cloudflare.com/).
    2. Select the domain you added to Readdy.
    3. Go to **SSL/TLS** > **Origin Server**.
    4. Under **Origin Certificates**, click **"Create Certificate"**.

    You can also open Cloudflare's [Origin Server page](https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls/origin) directly and select your domain.
  </Step>

  <Step title="Create an Origin CA Certificate">
    Choose **"Generate private key and CSR with Cloudflare"**, then confirm the default settings:

    * Keep the default **RSA (2048)** private key type unless your organization requires a different type.
    * Under **Hostnames**, Cloudflare automatically includes your root domain, such as `example.com`, and its wildcard domain, `*.example.com`. In most cases, you do not need to change these entries.
    * The wildcard covers first-level subdomains such as `www.example.com` and `app.example.com`. Only add another hostname if Readdy displays a domain that is not covered, such as `one.two.example.com`.
    * Keep the default **15 years** certificate validity unless your organization's security policy requires a shorter period.

    <Frame caption="Keep the default key type, hostnames, and 15-year validity unless your organization requires different settings">
      <img src="https://mintcdn.com/readdy/cuc4VGOPR-tLPBNV/images/cloudflare-origin-ca/cloudflare-origin-ca-create-certificate.png?fit=max&auto=format&n=cuc4VGOPR-tLPBNV&q=85&s=0ec78673e73697dedbd27fb192f7c1d0" alt="Cloudflare Origin CA certificate form with RSA 2048, root and wildcard hostnames, and 15-year validity selected" width="1752" height="812" data-path="images/cloudflare-origin-ca/cloudflare-origin-ca-create-certificate.png" />
    </Frame>

    Click **"Create"**.
  </Step>

  <Step title="Copy the Certificate and Private Key">
    Select **PEM** as the key format. Cloudflare displays two values:

    * **Origin Certificate**, beginning with `-----BEGIN CERTIFICATE-----`
    * **Private Key**, beginning with `-----BEGIN PRIVATE KEY-----` or `-----BEGIN RSA PRIVATE KEY-----`

    Copy each value in full, including the `BEGIN` and `END` lines.

    <Frame caption="Select PEM, then copy the Origin Certificate and Private Key separately">
      <img src="https://mintcdn.com/readdy/cuc4VGOPR-tLPBNV/images/cloudflare-origin-ca/cloudflare-origin-ca-copy-values.png?fit=max&auto=format&n=cuc4VGOPR-tLPBNV&q=85&s=697b72c5d2892983eaea3fe4bd0d9d1a" alt="Cloudflare Origin Certificate Installation page with PEM selected and the Origin Certificate ready to copy" width="1647" height="955" data-path="images/cloudflare-origin-ca/cloudflare-origin-ca-copy-values.png" />
    </Frame>

    <Warning>
      Cloudflare shows the private key only once. Store it securely before leaving the page. Never share it in a support ticket, email, chat, screenshot, or application log. If you lose it, create a new certificate and replace the old one in Readdy.
    </Warning>
  </Step>

  <Step title="Choose the SSL/TLS Scope">
    Before adding the certificate to Readdy, configure Cloudflare to use strict certificate validation for the Readdy hostnames. Keep the Readdy website records set to **DNS only** during this step.

    First, check whether other proxied hostnames in the same Cloudflare zone use different origin servers.

    <Warning>
      Do not change the zone-wide mode until you have checked every proxied origin. Enabling **Full (strict)** for an origin without a valid, unexpired certificate that matches its hostname can cause an Error 526.
    </Warning>

    Choose one of the following options:

    1. **Apply Full (strict) to the entire zone:** Use this option only when every proxied hostname in the zone points to an origin with a valid certificate. Go to **SSL/TLS** > **Overview**, set **SSL/TLS encryption mode** to **Full (strict)**, then click **"Save"**.
    2. **Apply Strict only to Readdy hostnames:** Use this option when the zone contains other origins or when you are unsure about their certificates. Keep the current zone-wide mode, then create a Cloudflare [Configuration Rule](https://developers.cloudflare.com/rules/configuration-rules/) that matches each Readdy hostname and sets **SSL** to **Strict**.

    <Frame caption="Set the zone-wide encryption mode to Full (strict) only after checking every proxied origin">
      <img src="https://mintcdn.com/readdy/cuc4VGOPR-tLPBNV/images/cloudflare-origin-ca/cloudflare-origin-ca-full-strict.png?fit=max&auto=format&n=cuc4VGOPR-tLPBNV&q=85&s=1976e481733a0c06374e65f07ae73d14" alt="Cloudflare SSL TLS Overview page with Full Strict encryption mode selected" width="1650" height="839" data-path="images/cloudflare-origin-ca/cloudflare-origin-ca-full-strict.png" />
    </Frame>
  </Step>

  <Step title="Add the Certificate to Readdy">
    1. Return to **Domain Settings** in Readdy.
    2. In the **Cloudflare Proxy** section, turn on the switch.
    3. Confirm that the domains shown in the modal are covered by your certificate.
    4. Paste the complete Origin Certificate into **Origin Certificate**.
    5. Paste the matching private key into **Private Key**.
    6. Select **"I have set Cloudflare SSL/TLS mode to Full (strict)"**.
    7. Click **"Save and enable"**.

    <Frame caption="Paste the matching certificate and private key, then confirm Full (strict) mode">
      <img src="https://mintcdn.com/readdy/cuc4VGOPR-tLPBNV/images/cloudflare-origin-ca/cloudflare-origin-ca-readdy-configuration.png?fit=max&auto=format&n=cuc4VGOPR-tLPBNV&q=85&s=5df60706494ab93016902d0fa5a56c54" alt="Readdy Configure Cloudflare Proxy dialog with certificate and private key fields" width="1037" height="910" data-path="images/cloudflare-origin-ca/cloudflare-origin-ca-readdy-configuration.png" />
    </Frame>

    Readdy validates the certificate format, private key, expiration date, and hostname coverage before enabling Cloudflare Proxy.

    Do not continue until Readdy displays **Enabled** and confirms that the Origin CA certificate is valid. If either status is missing, keep the Readdy website records set to **DNS only** and resolve the validation issue first.
  </Step>

  <Step title="Enable Proxying for the Readdy DNS Records">
    Go to **DNS** > **Records**, then change the required Readdy website records to **Proxied**, shown as an orange cloud.

    <Frame caption="Confirm that each required Readdy website record shows Proxied">
      <img src="https://mintcdn.com/readdy/cuc4VGOPR-tLPBNV/images/cloudflare-origin-ca/cloudflare-origin-ca-dns-proxied.png?fit=max&auto=format&n=cuc4VGOPR-tLPBNV&q=85&s=329c43a2427498bb8d3ca1f0763d0f3c" alt="Cloudflare DNS records page with the Readdy domain set to Proxied" width="1738" height="516" data-path="images/cloudflare-origin-ca/cloudflare-origin-ca-dns-proxied.png" />
    </Frame>

    <Warning>
      Cloudflare Origin CA certificates are trusted by Cloudflare, not by web browsers. Visitors may see certificate errors if you pause Cloudflare or switch a proxied record to **DNS only** while Readdy is using the Origin CA certificate.
    </Warning>
  </Step>

  <Step title="Verify the Configuration">
    Confirm each part of the setup:

    1. In Readdy, the **Cloudflare Proxy** section displays **Enabled** and shows that the Origin CA certificate is valid.
    2. In Cloudflare, each required Readdy website record displays **Proxied**.
    3. Open every configured hostname, including the root domain and any configured subdomains such as `www`, and confirm that each page loads over HTTPS without an Error 526.

    <Frame caption="Readdy displays Enabled after the Origin CA certificate is validated">
      <img src="https://mintcdn.com/readdy/cuc4VGOPR-tLPBNV/images/cloudflare-origin-ca/cloudflare-origin-ca-enabled.png?fit=max&auto=format&n=cuc4VGOPR-tLPBNV&q=85&s=d8f5c12144066b4b5b8ae570c11a8adb" alt="Readdy Domain Settings page with Cloudflare Proxy enabled" width="1036" height="850" data-path="images/cloudflare-origin-ca/cloudflare-origin-ca-enabled.png" />
    </Frame>

    You can now publish your website. Cloudflare caching may delay when the latest version appears to visitors.
  </Step>
</Steps>

## Troubleshooting

<AccordionGroup>
  <Accordion title="The Cloudflare Proxy section is not visible">
    **Symptom:** The **Cloudflare Proxy** section does not appear in Readdy.

    **Cause:** Readdy has not detected Cloudflare as the domain's authoritative DNS provider.

    **How to fix:** Confirm that the domain uses the Cloudflare nameservers assigned to your zone. Then wait for DNS propagation and refresh **Domain Settings**.
  </Accordion>

  <Accordion title="The certificate does not cover the domain">
    **Symptom:** Readdy reports that one or more domains are not covered by the certificate.

    **Cause:** The certificate does not cover every hostname shown in the Readdy modal.

    **How to fix:** Create a new Origin CA certificate that covers every hostname shown in Readdy. For a root domain and first-level subdomains, keep Cloudflare's default root and wildcard entries.
  </Accordion>

  <Accordion title="The certificate and private key do not match">
    **Symptom:** Readdy cannot validate the certificate and private key pair.

    **Cause:** The values may come from different certificate creation sessions or may be incomplete.

    **How to fix:** Copy both values again without removing the `BEGIN` or `END` lines. If the private key is no longer available, create a new certificate. The certificate and key must come from the same Cloudflare certificate creation session.
  </Accordion>

  <Accordion title="The certificate format is invalid">
    **Symptom:** Readdy reports that it cannot read the certificate.

    **Cause:** The certificate may be incomplete or use an unsupported format.

    **How to fix:** Select **PEM** in Cloudflare and paste the complete certificate value. Do not paste a PKCS#7 (`.p7b`) file or the Cloudflare Origin CA root certificate.
  </Accordion>

  <Accordion title="Cloudflare does not let you create a certificate">
    **Symptom:** Cloudflare displays an error when you create an Origin CA certificate.

    **Cause:** Your account may not have API Access or permission to manage SSL/TLS settings.

    **How to fix:** Ask the Cloudflare account owner to update your permissions or create the certificate for you.
  </Accordion>

  <Accordion title="Visitors see a certificate warning">
    **Symptom:** Visitors see a certificate error when they open your website.

    **Cause:** The website may be connecting directly to the Readdy origin instead of through Cloudflare.

    **How to fix:** Confirm that the required website DNS record is **Proxied** and that Cloudflare's SSL/TLS encryption mode is **Full (strict)**. Cloudflare Origin CA certificates are not designed for direct browser-to-origin connections.
  </Accordion>

  <Accordion title="Visitors see an Error 526 after enabling Full (strict)">
    **Symptom:** The website displays an Error 526 after you change the SSL/TLS mode to **Full (strict)**.

    **Cause:** Cloudflare cannot validate the certificate served by the origin. The certificate may not be active in Readdy, may be expired, or may not cover the requested hostname. If the error affects another hostname in the same zone, that hostname may use a different origin without a valid certificate.

    **How to fix:**

    1. Confirm that Readdy shows **Cloudflare Proxy** as **Enabled** and the Origin CA certificate as valid.
    2. Confirm that the certificate covers the affected hostname and has not expired.
    3. If only another hostname in the zone is affected, install a valid certificate on that origin or use a [Configuration Rule](https://developers.cloudflare.com/rules/configuration-rules/) to apply **Strict** only to the Readdy hostnames.

    Read Cloudflare's [Error 526 troubleshooting guide](https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-526/) for more details.
  </Accordion>
</AccordionGroup>

## Related Resource

Read the [Cloudflare Origin CA documentation](https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/) for more information about certificate creation, supported hostnames, and security requirements.

<Warning>
  Never include your private key in a support request.
</Warning>

## Need Help?

If this guide doesn't resolve your issue, [submit a support ticket](https://readdy.ai/feedback). We're here to help!