Cloudflare origin certificate expired

Expired Cloudflare origin certificates break strict SSL pulls even when visitors still trust Universal SSL at the edge.

When this happens

Cloudflare 525 errors while openssl to the public site looks fine. Terraform apply refreshed edge settings but origin PEM lived only on one metal machine in a now-Autoscaled pool.

Kubernetes still mounts a fifteen-year origin PEM that actually hit notAfter last week. Multi-cloud origin pools may hide one expired member behind healthy siblings intermittently.

First response

Cloudflare origin certificates expired under Full (strict)—renew origin PEMs on backends, not only edge Universal SSL.

Searches for cloudflare origin certificate expired usually mean automated renewal failed, succeeded locally but never reached the TLS listener, or hit Let's Encrypt rate limits. The fix is almost always permissions, challenge reachability, or a missing reload—not buying a longer-lived commercial cert as the first move.

For Cloudflare origin certificate expired, read the ACME or panel error verbatim, run a dry-run renewal if your stack supports it, then confirm what certificate strangers receive on port 443 after you deploy. Certificate files on disk lie; only live handshakes matter for users.

Origin certificates are Cloudflare-signed for traffic between edge and your server; they are not browser-trusted. When they expire, strict SSL modes break origin pulls even if visitors still see valid Universal SSL. Renew in the dashboard or replace with publicly trusted certs on the origin. Triage should capture timestamps, account URLs, and the last Boulder error type before infrastructure changes widen blast radius.

See also Cloudflare Universal SSL edge certificate issues and ACME DNS-01 challenge propagation delays.

Why renewal failed

Origin certs are Cloudflare-signed for backend trust, not browser trust stores. Origin cert renewals should be tracked in the same ticket system as public DV, with explicit owners for backends even when marketing only monitors orange-cloud URLs. Strict mode ties edge happiness to backend compliance—monitor both deliberately.

Full strict mode requires valid origin material on every pool member. Rolling origin pools need staggered reload validation so Cloudflare health checks do not flap during sequential PEM installs. Origin cert renewals belong in backend runbooks with owner names, not only CDN dashboards.

Edge renewal does not replace origin PEM installation. Origin pulls via authenticated tunnels still honor origin cert expiry on the far end.

Origin certs can last years but must be reinstalled on each backend listener. Orange-cloud visitors never see them, so monitoring must openssl the origin hostname or tunnel directly, not only the public site. Clarify in tickets whether failure is validation, issuance, deploy, or listener presentment—teams too often mix these phases when reading logs.

Expired origin cert is not fixed by renewing Universal SSL alone. It is not visible in consumer browser cert viewers when only edge TLS is inspected.

Common causes

These patterns drive most cloudflare origin certificate expired tickets. They explain why automation logs look green while browsers or APIs still break.

PaaS still mounted PEM from first install year.

Rotation playbook referenced wrong PEM bundle in Kubernetes secret.

Strict mode enabled without tracking origin notAfter. Workers routes calling origin subdomains bypass default pools, hitting expired certs on forgotten dev origins.

Diagnose

openssl directly to origin hostname or IP with correct SNI.

Compare Cloudflare SSL/TLS origin errors with openssl from inside their network diagram path. Run curl -v origin pull from Cloudflare diagnostic tools when available instead of guessing from edge status alone.

Fix step-by-step

Follow this sequence for cloudflare origin certificate expired. Capture command output after each step so the next responder can pick up without rerunning destructive changes.

1. Confirm SSL mode Full (strict) in zone settings.
2. Generate renewed origin cert with required SANs in dashboard.
3. Install PEM on each backend listener.
4. Reload web servers or ingress secrets.
5. Run Cloudflare SSL test or curl origin through tunnel.
6. Purge caches if needed for dynamic routes.
7. Document origin notAfter separately from edge monitoring.
8. Consider public LE on origin if policy allows.
9. Archive redacted ACME logs and openssl transcripts in the ticket before closing.
10. Schedule a follow-up dry-run before the next natural renewal window.

Verify the live certificate

OpenSSL

echo | openssl s_client -connect HOST:443 -servername HOST 2>/dev/null | openssl x509 -noout -dates -subject -issuer

Replace HOST with the public hostname on the certificate.

How to read the output

From bastion, openssl to origin IP with --servername matching origin hostname; issuer shows Cloudflare Origin CA.

curl

curl -vI --connect-timeout 10 https://HOST/ 2>&1 | grep -Ei 'expire|SSL certificate|subject:|issuer:'

Replace HOST with the public hostname users request.

Roll out and verify

Generate new origin cert covering required SANs in Cloudflare panel.

Install on origin, reload, validate Cloudflare SSL test passes. Align origin notAfter monitoring with Cloudflare SSL/TLS recommendation emails to the same on-call rotation.

Calendar reminder before multi-year origin expiry; consider public LE on origin instead.

What to automate

Monitor origin handshake notAfter from inside the same network path Cloudflare uses. Origin handshake checks from inside the same paths Cloudflare uses should alert separately from edge checks.

ssldays on customer URLs plus origin checks catches split edge/origin health. ssldays customer checks plus origin probes clarify two-layer TLS health.