Generate Certificate in Cloudflare

Learning Focus

By the end of this lesson you will know how to generate a Cloudflare Origin CA certificate from the dashboard.

Steps

1. Log into Cloudflare Dashboard → SSL/TLS → Origin Server
2. Click Create Certificate
3. Select Key type: RSA (2048) or ECDSA
4. Hostnames: Enter example.com and *.example.com
5. Certificate validity: 15 years (recommended for origin-only certs)
6. Click Create

Cloudflare displays:

• Origin Certificate (public key) — copy this
• Private Key — copy this (shown only once)

warning

Copy the private key immediately. Cloudflare will not show it again. If you lose it, you must generate a new certificate.

What You Get

Item	Use
Origin Certificate	Install on your server's SSL listener
Private Key	Pairs with the certificate — keep secret

Key Takeaways

• Cloudflare Origin CA certs are free and last up to 15 years.
• They are only trusted by Cloudflare — not by browsers directly.
• Copy the private key immediately — it is shown only once.

What's Next

• Continue to Download Certificate and Private Key for saving the files.