AutoSSL Not Working With Cloudflare? 3 Fixes for cPanel

You moved a site to Cloudflare, everything loads, and then cPanel starts flagging SSL problems. SSL/TLS Status shows a red warning, the certificate is close to expiry, and clicking Run AutoSSL changes nothing.

This guide explains why AutoSSL is not working with Cloudflare, how to read the error it gives you, and three fixes ranked from “set and forget” to “quick patch”. We also cover the step most guides skip: keeping AutoSSL alive for the subdomains that are not proxied, like mail..

On client sites we’ve seen this most often right after a DNS move, which is the same moment email tends to break. If your mail stopped too, see our guide to fixing email after switching to Cloudflare.

Why AutoSSL is not working with Cloudflare

AutoSSL has to prove you control a domain before it can get a certificate. cPanel does this with domain control validation (DCV), and it has two ways to try.

1. HTTP DCVcPanel places a temporary file under /.well-known/pki-validation/ and requests it over plain http://.
2. Cloudflare answers firstA proxied (orange cloud) record resolves to Cloudflare’s anycast IPs, not your server. If Always Use HTTPS, a security challenge or a site redirect touches that request, the check fails.
3. DNS DCV fallbackcPanel can’t add the validation record, because Cloudflare now hosts your DNS zone, not the cPanel server.
4. ResultNo new certificate. The old one runs down until it expires.

cPanel staff have said AutoSSL doesn’t support any type of redirection when it verifies a certificate.

So proxying alone does not always break AutoSSL. What breaks it is what happens to that plain HTTP request on the way. Cloudflare’s own docs say Always Use HTTPS redirects every http request to https, for all hosts, and it can’t be switched off for a single path. Most WordPress sites also force HTTPS in .htaccess or a plugin. Either redirect is enough to fail the check.

That is also why the problem looks random. A site with no HTTPS redirect and no bot challenge may pass, while the next one on the same server keeps failing.

Read the AutoSSL error before you change anything

Open cPanel > Security > SSL/TLS Status. If AutoSSL hit a problem for a domain, cPanel shows the error from its log next to that domain (server admins can read the full log in /var/cpanel/logs/autossl/). Match the message to the table below.

Which fix should you pick?

There are three practical options. They solve different problems, so pick based on how you run the site.

For most WordPress and WooCommerce sites that are staying on Cloudflare, fix 1 is the one we use. It removes the renewal problem instead of working around it.

Fix 1: Install a Cloudflare Origin CA certificate in cPanel

An Origin CA certificate is a free certificate issued by Cloudflare for the connection between Cloudflare and your server. Visitors still see Cloudflare’s public edge certificate, so nothing changes for them. Cloudflare lists it as a valid origin certificate for Full (strict) mode.

Step 1: Create the certificate in Cloudflare

1. In the Cloudflare dashboard, open your domain and go to SSL/TLS > Origin Server.
2. On the Origin Certificates tab, click Create Certificate.
3. Keep Generate private key and CSR with Cloudflare and choose RSA as the key type. Cloudflare’s docs warn against using its ECC root option with Apache cPanel, so RSA is the simpler path.
4. Check the hostnames. The apex (example.com) and first-level wildcard (*.example.com) are included by default.
5. Pick a Certificate Validity period and keep the key format as PEM.
6. Create the certificate, then copy the Origin Certificate and Private Key into two separate text files.

Step 2: Install it in cPanel

1. In cPanel, open Security > SSL/TLS.
2. Under Install and Manage SSL for your site (HTTPS), click Manage SSL sites.
3. Choose the domain, paste the certificate into Certificate (CRT) and the key into Private Key (KEY).
4. Cloudflare notes that some servers also need its Origin CA root certificate. If cPanel asks for one, paste Cloudflare’s RSA root into Certificate Authority Bundle (CABUNDLE). Then click Install Certificate.

Step 3: Set Cloudflare to Full (strict)

Go to the SSL/TLS Overview page and set the encryption mode to Full (strict). In this mode Cloudflare checks that your origin certificate is unexpired, issued by a public CA or Cloudflare’s Origin CA, and matches the hostname. If you were on Flexible, read our guide to the Cloudflare too many redirects loop first, because changing modes is where that loop starts.

Step 4: Exclude the proxied hostnames from AutoSSL

Back in cPanel > Security > SSL/TLS Status, tick the proxied hostnames (for example example.com and www.example.com) and use the exclude option. Depending on your cPanel version it’s labelled Exclude during AutoSSL or Exclude from AutoSSL. That stops AutoSSL trying, and failing, to issue certificates for names that Cloudflare now covers.

Fix 2: Set the record to DNS only while AutoSSL runs

If you want to stay on AutoSSL, you can let the check reach your server directly. A DNS-only (grey cloud) record makes Cloudflare return your server’s real IP, so cPanel’s HTTP check goes straight to Apache.

1. In Cloudflare, go to DNS > Records, click Edit on the A record for the root domain, switch Proxy status off (grey cloud) and click Save. Do the same for www.
2. Wait a few minutes, then in cPanel open SSL/TLS Status and click Run AutoSSL. cPanel shows “AutoSSL is in progress” while it works.
3. When the domain shows a valid AutoSSL certificate, turn Proxy status back on for both records.
4. Set Cloudflare to Full (strict). A fresh AutoSSL certificate is publicly trusted, so it passes.

The same idea explains the popular “pause Cloudflare, run AutoSSL, unpause” workaround. It works, but it takes the whole zone off Cloudflare and puts the burden on someone to remember it.

Fix 3: Full mode as a stopgap

If the origin certificate has already expired and visitors are seeing error 526, setting the encryption mode on the SSL/TLS Overview page to Full gets the site back immediately. Full mode accepts expired, self-signed or mismatched origin certificates because it doesn’t validate them at all. Cloudflare warns that this lets a malicious party present their own certificate, so treat it as a bridge to fix 1, not a destination.

Keep AutoSSL for mail and other DNS-only subdomains

Don’t exclude the whole account from AutoSSL. Mail and FTP records such as mail and ftp must stay DNS only in Cloudflare, and many sites leave webmail and cpanel grey too. A DNS-only hostname resolves straight to your server, so AutoSSL can still validate it normally.

That matters because mail apps connect to mail.example.com directly. They need a publicly trusted certificate, and an Origin CA certificate would show them a trust warning. So the clean split looks like this:

What to check afterwards

1. Load the site in a private window. The padlock certificate should be Cloudflare’s edge certificate, not your Origin CA one.
2. Open a few inner pages and the WordPress login. A 526 here means the origin certificate doesn’t match the hostname or wasn’t installed for that domain.
3. In SSL/TLS Status, confirm the proxied names show as excluded and mail. still has a valid AutoSSL certificate.
4. Send a test email from your phone’s mail app to make sure the mail certificate is still trusted.
5. Write down the Origin CA expiry date somewhere you’ll see it.

Common mistakes to avoid

• Switching to Flexible to “make SSL work”. Cloudflare’s docs confirm Flexible sends traffic from Cloudflare to your server unencrypted, and on WordPress it often causes a redirect loop.
• Installing an Origin CA certificate, then grey-clouding the record. Cloudflare’s docs say visitors may see untrusted certificate errors if you pause Cloudflare or disable proxying on hostnames that use one.
• Excluding every domain from AutoSSL. That leaves mail. and webmail. to expire.
• Leaving Cloudflare on Full permanently. It hides the warning sign that your origin certificate is broken.

Frequently asked questions

Sources: cPanel: AutoSSL Fails with DNS Resolution Errors; cPanel: Local HTTP DCV error 404; cPanel staff on AutoSSL and Cloudflare; cPanel docs: SSL/TLS Status; cPanel docs: SSL/TLS; Cloudflare: Origin CA certificates; Cloudflare: Full (strict); Cloudflare: Full; Cloudflare: Encryption modes; Cloudflare: Always Use HTTPS; Cloudflare: Proxy status; Cloudflare: Error 526. Checked October 2026.

More in How-To & Fixes

How-To & Fixes

Squarespace Tax Not Showing at Checkout? 6 Fixes to Try

Squarespace tax not showing at checkout? Find the cause in your automated or manual setup, registrations or Include in price, and fix it in minutes.

Oct 21, 2026 · 9 min read

How-To & Fixes

WordPress REST API Returning Old Data? Fix the Cache

WordPress REST API returning old data? Find the cache serving stale JSON, then bypass /wp-json/ in Cloudflare, LiteSpeed or WP Rocket and purge it.

Oct 19, 2026 · 9 min read

How-To & Fixes

WooCommerce Showing Wrong Currency? 5 Fixes That Work

WooCommerce showing wrong currency? Find the setting, plugin, code snippet or cached page behind it and fix the symbol, prices and store location.

Oct 17, 2026 · 8 min read