2

So usually I just create a letsencrypt certificate and setup it up, then i open up the browser and click the "LOCK" icon and check the certificate info, this tells me that my setup actually worked and was installed correctly.

What I ran into today, is that I am doing this for a domain name that is using Cloudflare DNS, so Cloudflare sits between the browser and the server/site. When I click the "LOCK" icon, i see Cloudflare SSL info.

What is the best approach to validate that the letsencrypt cert is actually working on the server/site side?

farinspace
  • 173
  • 1
  • 1
  • 13

2 Answers2

3

One can use curl to connect directly to the origin server:

curl -v --resolve www.example.com:443:ip.of.origin.server https://www.example.com

The --resolve argument tells curl to bypass DNS request for www.example.com for port 443 (TLS) connections, and instead use ip.of.origin.server as the destination address.

Another option is to add an entry for your domain and origin server in /etc/hosts (Linux) or c:\Windows\SYSTEM32\Drivers\etc\hosts.txt. After one can check the connection with any tool.

Tero Kilkanen
  • 36,796
  • 3
  • 41
  • 63
  • 2
    Or `openssl s_client -connect $address:$port -servername $hostname | openssl x509 -noout -text` connects directly to the address but allows you specify what the FQDN 'would have been' for SNI – dave_thompson_085 Jul 06 '20 at 02:36
1

On a free cloudflare plan you cannot import your own SSL certificate.

The only option inside the cloudflare account is to disable the proxy for the "A" record (and/or other appropriate DNS records). Once set, requests will bypass cloudflare and show the original server's IP address, the server's available SSL certificate will also be used.

farinspace
  • 173
  • 1
  • 1
  • 13
Nirmal
  • 45
  • 2
  • 1
    But that way, won't Cloudflare be bypassed? Unless he does it temporarily, just to check and revert the records back later. – Krackout Jul 03 '20 at 16:35
  • @Krackout, I agree, i really just need to be able to check that the other side of the proxy is actually encrypted and using the correct cert. – farinspace Jul 03 '20 at 16:55