Replace the self-signed certificate with a trusted one on Cloudflare
Why it matters
A self-signed certificate is not vouched for by any authority browsers trust, so every visitor sees a security warning. Many API clients refuse the connection altogether.
The fix
- Proxy the record (orange cloud). Cloudflare then presents its own trusted edge certificate to visitors.
- Install a Cloudflare Origin CA certificate (SSL/TLS then Origin Server then Create Certificate) or a public certificate on your server first. Only then set SSL/TLS encryption mode to Full (strict), because strict mode rejects a self-signed origin certificate and would take the site down.
- Origin CA certificates are trusted only by Cloudflare, so use them only while the record stays proxied.
Related
- Reported by the certificate chain and expiry check
- Renew the expired TLS certificate
- Fix a certificate that is not valid yet
- Renew the certificate before it expires
- Install a certificate that covers this hostname
- Use a certificate from a publicly trusted authority
- Serve the full certificate chain
- Replace the expired intermediate certificate
- Re-issue the certificate with a stronger key
- Replace the certificate that uses a broken hash
- Fix the certificate that browsers reject
Scan your domain to see whether this applies to you.