docs: document migrating an existing domain to Cloudflare Origin CA - #172
Open
onlyilkr wants to merge 1 commit into
Open
docs: document migrating an existing domain to Cloudflare Origin CA#172onlyilkr wants to merge 1 commit into
onlyilkr wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
Using Cloudflare's Origin CAguide assumes a domain that never had a Let's Encrypt certificate. When one already exists, following every step still leaves Traefik serving the old certificate, and Cloudflare returns Error 526 inFull (Strict)mode once it expires — with nothing in the docs pointing at the cause.This adds, inside the existing Origin CA section:
Migrating a domain that already used Let's Encrypt: removing the entrypoint-levelcertResolver, clearing the old entry fromacme.json, restarting TraefikVerifying the certificate is actually being served: checking the origin withopenssl, a table mapping each wrong result to its cause, and a warning thatcurlthrough Cloudflare Access never reaches the originContent only, no existing lines removed.
It also gives a concrete answer to the open note in
core/certificates.mdx("This action will create the files, but that doesn't mean it will work automatically. You need to adjust the Traefik configuration to use it"), which currently does not say how.Related to Dokploy/dokploy#4949.