No SSL Certificate to Web Server after Disabling Cloudflare A-Record
Proxy
reddit / selfhosted

----------------------------------------------------------------------
zfa · 2023-10-11 06:35

All disabling proxying does in the Cloudflare dash is have them 'get
out of the way', so I guess your problem is:

*"My NextCloud set up with npm serves a self-signed cert."*

Outside of that you have a lot of other moving parts which could be
fucking you up, including but not limited to:

* If you've disabled proxying then you can't restrict access to just
Cloudflare IP ranges as visitors will come directly to you.

* If you're really using the literal domain 'ip.com' you're gonna have
a bad time unless you do own/admin that domain. If you're using ip.com
to mean something else then we don't know what that is. If you don't
want to divulge your name, follow standards and replace with
`example.com` or something.

* SSL mode at CLoudflare won't affect anything with proxying disabled
messing with it won't do anything and clouds th eissue your'e trying
to resolve tbh.

* nginx won't have a LE cert 'from Cloudflare', it'll be from Let's
Encrypt - presumably you mean you use CLoudflare for DNS challenge?

Note that the 100MB limit of uploads with CLoudflare cna be icnreased
on pricier plans, and that the size mentioned is just per chunk of
data sent I think. not sure how NextCloud divies stuff up.

My advice would be to turn off proxying, make sure you really do have
'grey cloud', flush and DNS and browser caches, check what your
problem is and repost without any reference to Cloudflare settings etc
as it's likely going to confuse people and lead to less responses for
you. GL.

----------------------------------------------------------------------
ThanEEpic · 2023-10-11 07:11

This is all great information, so thanks! Yeah okay so let me clear
this up a bit.

* Good to know that I can't restrict my IPs to Cloudflare if I'm not
using their proxy. That would have absolutely bit me in the ass pretty
soon.
* No I'm not actually using that domain. I'm using
[`my.ip.com`](https://my.ip.com) just like you would `example.com` .
Different strokes for different folks, and different corners of the
internet apparently.
* No, I'm more curious as to WHY I'm seeing Cloudflare-gen'd certs but
it makes sense now. Now the question is why the hell aren't I seeing
my Let's Encrypt cert?
* Yeah there was a bit of a miscommunication on my end as I try to
make sure I'm using the right terminology. Cert management and proxies
are something I've never personally done before, but I'm getting
there.
* That would make sense if it was by chunks because my users can still
upload multi-gb sized files no problem.
* Will do! Thanks!

----------------------------------------------------------------------
ThanEEpic · 2023-10-15 02:54

SOLVED:

I did what r/zfa advised and it worked! I removed my port forwarding
rules about only allowing Clouflare's IPs, turned off the proxy
setting in the Cloudflare dashboard, and allowed the browser to adjust
to the Let's Encrypt certificate instead of the google certificate
that Cloudflare was using. All is working now, so thanks everyone!