# Cloudflare 15-Year Free SSL Certificate: Complete Setup Guide
Renewing SSL certificates every 90 days is a chore that many site owners know all too well. Free certificates from providers like Let’s Encrypt or various cloud platforms typically carry a three-month validity window, which means constant renewal cycles and the risk of a forgotten expiration taking your site offline. Cloudflare offers a compelling alternative: an **Origin Certificate** that is free, supports wildcard domains, and stays valid for up to **15 years**.
This guide explains what the Cloudflare Origin Certificate is, walks through its pros and cons, and provides step-by-step instructions for generating and deploying it across common web server stacks.
—
## What Is a Cloudflare Origin Certificate?
Cloudflare provides several SSL/TLS modes for traffic flowing between visitors, its edge network, and your origin server:
– **Flexible SSL** — Encrypts the connection between the visitor and Cloudflare’s edge. The origin server does not need any certificate. This is the least secure option.
– **Full SSL** — Encrypts visitor-to-edge traffic and also encrypts edge-to-origin traffic, but the origin server may use a self-signed certificate.
– **Full SSL (Strict)** — Same as Full SSL, but the origin server must present a certificate from a trusted certificate authority.
– **Origin Certificate** — A free certificate issued directly by Cloudflare’s internal CA, designed to sit on your origin server. It can cover your apex domain and all subdomains via a wildcard entry, and it remains valid for up to 15 years.
The Origin Certificate is the focus of this guide. It secures the connection between Cloudflare’s edge nodes and your origin server. Because it is only ever seen by Cloudflare (not by end-user browsers), it does not need to come from a publicly trusted CA like DigiCert or Let’s Encrypt — Cloudflare’s edge automatically trusts certificates it issued itself.
—
## Pros and Cons of the 15-Year Origin Certificate
### Advantages
– **Free with a long validity period.** Unlike most free certificates that expire every 90 days, the Cloudflare Origin Certificate is issued once and valid for up to 15 years, eliminating recurring renewal tasks.
– **Wildcard support.** A single certificate can protect both the apex domain (`example.com`) and every subdomain (`*.example.com`), which is ideal for sites running multiple subdomains or services.
– **Simple issuance.** No CSR generation or domain-control validation email is required. The certificate is generated in a few clicks inside the Cloudflare dashboard.
– **Native Cloudflare integration.** The edge network automatically trusts the certificate, so no extra trust-chain configuration is needed for proxy traffic to work.
– **Choice of key types.** You can select RSA (2048-bit) or ECC (ECDSA P-256) depending on your compatibility and performance needs.
– **Lower operational overhead.** With a 15-year validity window, certificate-expiry alerts become a non-issue for the foreseeable future.
### Limitations
– **Only works behind Cloudflare.** The certificate is trusted solely by Cloudflare’s edge. If you point your DNS directly at your origin server (bypassing Cloudflare’s proxy), browsers will show a security warning.
– **Not a publicly trusted CA.** Because the certificate is issued by Cloudflare’s internal CA, it cannot serve as a standalone public-facing certificate outside of the Cloudflare proxy model.
– **Requires Cloudflare proxy (orange cloud).** Your DNS records must be proxied through Cloudflare for the end-to-end encryption chain to function correctly.
– **Vendor lock-in.** If you later migrate away from Cloudflare, this certificate stops being useful and you will need a replacement from a public CA.
For any site that already uses Cloudflare’s CDN, the advantages comfortably outweigh the limitations.
—
## Prerequisites: Prepare Your Domain
Before generating the certificate, make sure your domain is fully set up in Cloudflare.
### 1. Create a Cloudflare Account
If you do not yet have one, sign up at the Cloudflare dashboard. The Free Plan is sufficient — the Origin Certificate feature is available at no cost on the free tier.
### 2. Add and Delegate Your Domain
1. Log in to the Cloudflare dashboard and click **Add Site**.
2. Enter your domain name.
3. Select the **Free Plan**.
4. Cloudflare will scan and import your existing DNS records. Review them for accuracy before continuing.
5. Cloudflare assigns two nameservers (for example, `alex.ns.cloudflare.com` and `uma.ns.cloudflare.com`).
6. Log in to your domain registrar (GoDaddy, Namecheap, Alibaba Cloud, etc.) and replace the current nameservers with the pair Cloudflare provided.
7. Wait for DNS propagation — this can take anywhere from a few minutes to 48 hours.
### 3. Confirm Proxy Status
Once your domain is active in Cloudflare, ensure the DNS records for your apex domain and any subdomains show the **orange cloud** icon, indicating that Cloudflare proxying is enabled. Only proxied records benefit from Cloudflare’s SSL features.
—
## Step-by-Step: Generate the Origin Certificate
### Step 1 — Open the Origin Server Page
In the Cloudflare dashboard, select your domain, then navigate to **SSL/TLS → Origin Server** in the left sidebar.
### Step 2 — Create the Certificate
Click **Create Certificate**. In the form that appears, configure the following:
– **Private key type:** Choose **RSA (2048)** for broad compatibility or **ECC (ECDSA P-256)** for better performance and shorter keys. ECC is recommended for most modern setups.
– **Hostnames:** Enter your apex domain and the wildcard to cover all subdomains:
“`
yourdomain.com
*.yourdomain.com
“`
– **Certificate validity:** Select **15 years**.
Click **Create** to generate the certificate.
### Step 3 — Download the Certificate and Private Key
Cloudflare displays two blocks of text:
– **Origin Certificate** — a PEM-formatted certificate beginning with `—–BEGIN CERTIFICATE—–`
– **Private Key** — a PEM-formatted key beginning with `—–BEGIN PRIVATE KEY—–` (or the RSA/EC variant)
> **Critical:** Copy and save the private key immediately. Once you leave this page, Cloudflare will not show the private key again. Store both files securely, for example as `origin-cert.pem` and `origin-key.pem`.
You will also see a **Cloudflare Origin CA root certificate** available for download. This is used to build a complete trust chain in certain configurations (explained below).
—
## Deploy the Certificate on Your Web Server
### Option A — Nginx
Locate your Nginx configuration file (commonly in `/etc/nginx/nginx.conf` or `/etc/nginx/sites-available/`) and update the server block for your site:
“`nginx
server {
listen 443 ssl http2;
server_name yourdomain.com;
ssl_certificate /path/to/origin-cert.pem;
ssl_certificate_key /path/to/origin-key.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers HIGH:!aNULL:!MD5;
root /var/www/html;
index index.html index.php;
}
“`
Test the configuration and reload:
“`bash
nginx -t
systemctl restart nginx
“`
### Option B — Apache
First, ensure the SSL module is enabled:
“`bash
a2enmod ssl
systemctl restart apache2
“`
Then edit your virtual host file (typically under `/etc/apache2/sites-available/`):
“`apache
ServerName yourdomain.com
SSLEngine on
SSLCertificateFile /path/to/origin-cert.pem
SSLCertificateKeyFile /path/to/origin-key.pem
DocumentRoot /var/www/html
“`
Validate and restart:
“`bash
apachectl configtest
systemctl restart apache2
“`
### Option C — BT Panel (Baota / aaPanel)
For users of popular server control panels like BT Panel:
1. Log in to the panel and open the **Websites** section.
2. Find your site and click **Settings**.
3. Switch to the **SSL** tab and select **Other Certificate** (or the equivalent manual entry option).
4. Paste the contents of `origin-cert.pem` into the **Certificate (PEM)** field.
5. Paste the contents of `origin-key.pem` into the **Key** field.
6. Click **Save**.
7. Enable **Force HTTPS** to redirect all HTTP requests to HTTPS automatically.
The panel applies the certificate and, in most cases, reloads the web server for you — no manual restart needed.
—
## Optional: Configure the CA Root Certificate
For most proxied Cloudflare setups, the origin server only needs to present the Origin Certificate itself — Cloudflare’s edge already trusts it. However, if you want a complete certificate chain for compatibility or auditing reasons, you can append the Cloudflare Origin CA root certificate:
“`bash
cat origin-cert.pem cloudflare-origin-ca-root.pem > fullchain.pem
“`
Then reference the bundled file:
– **Nginx:** `ssl_trusted_certificate /path/to/fullchain.pem;`
– **Apache:** `SSLCertificateChainFile /path/to/cloudflare-origin-ca-root.pem`
This step is optional for standard Cloudflare-proxied traffic.
—
## Verify Your SSL Configuration
After deployment, confirm everything is working correctly.
### Browser Check
Visit `https://yourdomain.com` and look for the padlock icon in the address bar. Click it to inspect the certificate details — verify the issuer, hostname coverage, and validity dates.
### Online Tools
– **SSL Labs** (`ssllabs.com/ssltest/`) — run a full SSL analysis and check your overall grade.
– **Why No Padlock** (`whynopadlock.com`) — detect mixed-content issues that can break the padlock.
– **curl** — a quick command-line check:
“`bash
curl -vI https://yourdomain.com
“`
### OpenSSL Inspection
Use OpenSSL to view the certificate’s internal details:
“`bash
openssl x509 -in origin-cert.pem -text -noout
“`
Confirm that the **Issuer** is Cloudflare’s CA, the **Subject** includes your domains, the **Validity** spans 15 years, and the **Subject Alternative Names** list every hostname you requested.
—
## Common Questions and Troubleshooting
### What if I lose the private key?
Private keys cannot be recovered. Go to **SSL/TLS → Origin Server**, revoke the old certificate, and generate a new one. Then redeploy the new certificate and key to your origin server.
### Do I need renewal reminders?
Technically, yes — even a 15-year certificate eventually expires. You can check the expiry date anytime in the Cloudflare dashboard. Setting a calendar reminder a few months before the 15-year mark is good practice.
### Will it work with another CDN in front?
If you layer another CDN (such as Alibaba Cloud CDN) between visitors and Cloudflare, the Origin Certificate may not function correctly because the intermediate CDN will not trust Cloudflare’s internal CA. In multi-CDN scenarios, use a certificate issued by a public CA instead.
### Are old clients affected?
End users never see the Origin Certificate directly — they see the publicly trusted certificate Cloudflare serves from its edge. Compatibility issues with the internal CA only affect direct origin connections, which normal visitors never make.
—
## Summary
The Cloudflare 15-year free Origin Certificate is one of the most practical SSL options available for any site already using Cloudflare’s CDN. It eliminates the renewal treadmill, supports wildcard subdomains at no cost, and integrates seamlessly with Cloudflare’s proxy. The trade-off — that the certificate only works behind Cloudflare — is a non-issue for sites committed to the platform.
This approach is especially well suited for:
– Personal blogs and small business websites
– Sites running multiple subdomains that need a single wildcard certificate
– Teams looking to minimize certificate management overhead
– Anyone already on Cloudflare’s free plan
Spend a few minutes configuring it today, and you can effectively set certificate management aside for the next decade and a half.
—
*Cloudflare’s interface, certificate policies, and feature availability may change over time. The steps above reflect the dashboard layout and capabilities described in the source material; verify current options in your own Cloudflare dashboard before proceeding.*
