# Cloudflare Free 15-Year SSL Certificate: Complete Setup Guide
Securing a website with HTTPS is no longer optional — browsers flag unencrypted sites, search engines rank them lower, and visitors lose trust. For years, the standard answer was Let’s Encrypt or similar providers offering free certificates valid for 90 days. That works, but the short validity window means automating renewal and dealing with occasional renewal failures. If you have ever had a site break at 3 a.m. because a certificate silently expired, the appeal of a long-lived certificate is obvious.
This guide covers Cloudflare’s free Origin CA certificate, which can be issued for up to 15 years and supports wildcard domains. It walks through why you might choose it, what trade-offs to expect, the prerequisites, and the full step-by-step setup from generating the certificate to deploying it on your server and configuring Cloudflare’s encryption mode.
> **Recency note:** Cloudflare’s interface, plan names, and certificate options can change over time. The steps below reflect how the dashboard worked at the time of writing. Verify the current flow in Cloudflare’s documentation or dashboard before you begin, especially around validity periods and supported key types.
## Why a 15-Year Certificate Matters
Most free SSL certificates available from cloud providers come with a 90-day (3-month) validity period. That means renewing them four times a year, either manually or through an automated ACME client like Certbot. Automation helps, but it introduces a moving part — if the renewal job fails silently, your site can go dark until you notice.
Cloudflare’s Origin Certificate offers a different model. Instead of issuing a short-lived certificate that browsers trust directly, Cloudflare issues a long-lived certificate (up to 15 years by default) that secures the connection between Cloudflare’s edge network and your origin server. Visitors connect to Cloudflare over a standard publicly trusted certificate, and Cloudflare connects to your server using the Origin Certificate. This is a common architecture known as a reverse proxy SSL setup.
### Advantages
– **Long validity.** A default lifespan of up to 15 years eliminates the need for frequent renewals. You install it once and do not have to think about it again for a long time.
– **Wildcard support.** A single certificate can cover your apex domain and unlimited subdomains through wildcard notation (for example, `*.example.com`).
– **Free CDN included.** Hosting your DNS on Cloudflare gives you access to their content delivery network at no cost, which can improve global page-load times and absorb traffic spikes.
– **Origin IP protection.** Because Cloudflare sits in front of your server, visitors see Cloudflare’s edge IPs rather than your origin server’s real IP address. This hides your server from direct attacks and reduces exposure to targeted DDoS attempts.
### Things to Keep in Mind
– **DNS must be on Cloudflare.** This is a hard requirement. You cannot use an Origin Certificate unless your domain’s DNS is delegated to Cloudflare’s nameservers.
– **Possible latency for certain regions.** Because all traffic routes through Cloudflare’s edge, users in regions far from Cloudflare data centers — or behind networks with poor routing to those centers — may experience slower response times. This is worth testing for your target audience.
– **Hosting provider compatibility.** Some hosting providers restrict features or block traffic that passes through a CDN or proxy. Check with your host if you run into issues.
## Prerequisites
Before you begin the certificate setup, make sure the following are in place:
1. **A Cloudflare account.** Sign up at `https://www.cloudflare.com/` if you do not already have one.
2. **Your domain added to Cloudflare.** After logging in, add your domain. Cloudflare will scan your existing DNS records and import them.
3. **DNS delegated to Cloudflare.** At your domain registrar (where you purchased the domain), update the nameservers to the pair Cloudflare assigns you — for example, `coco.ns.cloudflare.com` and `shane.ns.cloudflare.com`. DNS propagation can take anywhere from a few minutes to several hours.
4. **Select the Free plan.** During the add-site flow, Cloudflare presents several paid plans. For basic SSL and CDN, scroll to the bottom and choose the Free plan. You can upgrade later if needed.
Once your domain shows an **Active** status in Cloudflare, you are ready to generate the certificate.
## Step 1: Generate the Origin Certificate
1. From your Cloudflare dashboard, select the domain you want to secure from the site list.
2. In the left-hand navigation, click **SSL/TLS**, then open the **Origin Server** tab.
3. Click **Create Certificate**.
This opens the certificate creation wizard.
## Step 2: Configure Certificate Parameters
Cloudflare gives you control over several options:
– **Private key generation.** You can let Cloudflare generate the private key and CSR for you (recommended for most users), or provide your own CSR. If Cloudflare generates it, choose the key type: **RSA** or **ECC**. RSA is the most widely compatible; ECC produces smaller, faster keys but requires slightly newer infrastructure.
– **Hostnames covered.** Enter the hostnames the certificate should protect. Wildcard notation (for example, `*.example.com`) covers all first-level subdomains and is included by default along with the apex domain. If you need deeper subdomains (such as `one.two.example.com`), add them explicitly in this field.
– **Validity period.** The default is 15 years. You can shorten this if your security policy requires shorter certificate lifespans.
– **Key format.** Choose based on your server stack:
– **PEM** — for Apache, Nginx, and most Linux-based servers.
– **PKCS#7** — for Windows and Tomcat-based servers.
Double-check your hostname entries before proceeding. Adding a hostname after issuance requires generating a new certificate.
## Step 3: Save the Certificate and Private Key
When you click **Create**, Cloudflare generates the certificate and displays both the **Origin Certificate** and the **Private Key** on screen.
This is a critical moment:
> **You will not be able to view the private key again after you leave this page.** Save it immediately.
Recommended practice:
1. Copy the private key into a file named `private.key`.
2. Copy the certificate into a file named `certificate.pem`.
3. Store both files in a secure, backed-up location. If you lose the private key, you will have to revoke the certificate and generate a new one.
Treat the private key with the same care as any server credential — restrict file permissions, avoid emailing it, and never commit it to version control.
## Step 4: Install the Certificate on Your Server
How you install the certificate depends on your server environment. If you use a control panel such as 1Panel, cPanel, or a similar tool:
1. Navigate to the SSL or certificate management section.
2. Choose the option to upload or install a custom certificate.
3. Paste the contents of `certificate.pem` into the certificate field.
4. Paste the contents of `private.key` into the private key field.
5. Save and apply.
If you manage the server directly (for example, Nginx or Apache config files), reference the two files in your server block or virtual host configuration and reload the web server.
## Step 5: Configure the Root Certificate (If Required)
Some servers require the Cloudflare root CA certificate to be installed alongside the origin certificate for proper chain validation. Cloudflare provides these for download:
– **Cloudflare Origin ECC PEM** — for certificates generated with an ECC key.
– **Cloudflare Origin RSA PEM** — for certificates generated with an RSA key.
**Important:** If you are on Apache with cPanel, do **not** use the ECC root. Stick with the RSA version to avoid compatibility issues.
## Step 6: Set the SSL Encryption Mode in Cloudflare
After the certificate is installed on your server, return to the Cloudflare dashboard to configure how traffic flows:
1. Under **SSL/TLS**, open the **Origin Server** tab and enable **Authenticated Origin Pulls**. This ensures that connections from Cloudflare to your origin are mutually authenticated, adding an extra layer of verification.
2. Switch to the **Overview** (or edge) tab and select an encryption mode:
– **Full (Strict)** — recommended. Cloudflare encrypts traffic to your origin and verifies the certificate. This is the most secure option when using an Origin Certificate.
– **Full** — encrypts traffic to the origin but does not verify the certificate. Less secure than Full (Strict); use only if you have a specific reason.
Avoid the **Flexible** mode. In Flexible mode, traffic between Cloudflare and your origin is sent in plaintext, which defeats much of the purpose of having a certificate. If you have installed an Origin Certificate, Full (Strict) is the correct choice.
## Verifying Your Setup
Once everything is configured, test your site:
– Open your site in a browser and confirm the connection is HTTPS with no warnings.
– Use an online SSL checker to verify the certificate chain and confirm the issuer is Cloudflare.
– Check that subdomains covered by the wildcard also load securely.
– Inspect your origin server logs to confirm requests are arriving from Cloudflare IPs, not directly from visitors (which would indicate your origin IP is exposed).
## Common Pitfalls
– **Losing the private key.** As noted, the private key is shown only once. Generate the certificate in a session where you can immediately copy and save both values.
– **Forgetting to switch from Flexible to Full (Strict).** Leaving Cloudflare in Flexible mode means the Cloudflare-to-origin leg is unencrypted, which is a serious security gap.
– **Mismatched key format.** Installing a PEM certificate where a PKCS#7 is expected (or vice versa) will cause the server to reject it. Match the format to your server stack from the start.
– **DNS not fully propagated.** If Cloudflare still shows a pending status, certificate features may not be fully active. Wait for the domain to reach Active status before proceeding.
## Summary
Cloudflare’s free Origin Certificate is a practical option for anyone who wants long-lived, wildcard-capable SSL without the renewal overhead of 90-day certificates. The trade-off is that it requires moving your DNS to Cloudflare and routing traffic through their network — a model that adds CDN and IP-protection benefits but may introduce latency for specific regions or hosting setups.
For most websites, the combination of a 15-year certificate, free CDN, and origin IP protection is well worth the migration effort. Just save your private key, choose Full (Strict), and verify the setup with an SSL checker before calling it done.
