How to Use AutoSSL with Cloudflare

The Cloudflare content delivery network (CDN) service works well when you need a faster website and your web hosting plan doesn’t include an SSL certificate. In this case, you’d likely be using Flexible SSL mode. This means only traffic between your viewers and Cloudflare is encrypted, not between Cloudflare and your origin web server. This can cause some problems:

Mixed content errors preventing images from loading with HTTPS (test with tools like WhyNoPadlock.com)
Redirect loop errors preventing the entire page from loading in your browser
Your website may use a wildcard SSL shared with phishing sites using Cloudflare for valid SSLs (test with tools like Nmap and SSL Shopper SSL Checker)
Since traffic between Cloudflare and your server isn’t encrypted, it’s vulnerable to man-in-the-middle (MITM) cyber attacks such as SSL stripping and HTTP downgrade attacks

All InMotion cPanel-managed plans include the free AutoSSL for those who don’t need a paid SSL, usually recommended for e-commerce sites. This way you can still provide end-to-end encryption for your visitors and mitigate the aforementioned errors and cyber attacks, regardless of whether you’re using a CDN or web application firewall (WAF) such as Sucuri. With Cloudflare, this is achieved with the Full (Strict)mode. Below we’ll cover:

Ways to bypass Cloudflare
How to use AutoSSL with Cloudflare

Learn more about how to secure cPanel accounts with our Managed Reseller VPS hosting.

Check Your Website Without Cloudflare

You may see this as an indirect how-to for potential cyber attackers. It’s understandable. However, sometimes it’s important to understand how easy some attacks are to fully realize why you should work to mitigate it. Furthermore, the information below is discussed for other benign situations, such as testing a website before updating nameservers or transferring a domain to another registrar.

You may already know you can enable Development mode in Cloudflare to temporarily bypass the CDN’s caching functions.

But anyone can edit their computer hosts file, adding a row with a domain and specific server IP, to force DNS queries to another server regardless of authoritative DNS records.

If the yourwebsite.com A record is 1.2.3.4, but I want to rebuild the website on my server, I can simply add this to my computer hosts file to redirect all requests from my computer to my server instead.

9.8.7.6 yourwebsite.com www.yourwebsite.com

Basically, in many cases, it’s easy to find and connect to a website’s origin IP address, bypassing a CDN or WAF.

This is the basic concept behind many DNS cache poisoning attacks on workstations, network routers, and rogue Wi-Fi access points (WAPs).

If your domain is pointed to Cloudflare name servers, you can edit the hosts file to see check if your website redirects to HTTPS without enabling Cloudflare Development mode — which affects all users.