15-Year Origin CA SSL Certificates
Origin CAGenerate and manage free 15-year Cloudflare Origin CA SSL certificates for origin web servers.
📖 Full Explanation
To achieve Full (Strict) SSL without worrying about Let's Encrypt 90-day renewal certbot failures, Cloudflare provides free 15-year Origin CA certificates. \1 generates a private key, requests the signed certificate from Cloudflare's CA, and writes ready-to-use PEM files for Nginx or Apache.
⚙️ Command Options & Flags
| Option / Flag | Description | Default |
|---|---|---|
| -d, --days <validity> | Certificate validity period in days (up to 5475 days / 15 years) | 5475 |
| -h, --hostnames <list> | Comma-separated hostnames covered (e.g. example.com, *.example.com) | domain + wildcards |
| -o, --out <dir> | Directory to save cert.pem and key.pem | ./certs |
🔬 Technical Corollary & Edge Mechanics
Calls \1 on Cloudflare's Origin CA API using ECDSA P-256 or RSA 2048 keys. Origin CA certificates are trusted exclusively by Cloudflare edge proxies, providing end-to-end encryption without third-party renewal complexities.
🎯 Real-World DevOps Use Cases
Zero-Maintenance Origin HTTPS
Install a 15-year certificate on an Ubuntu Nginx server once and never renew again.
Multi-Subdomain Wildcard Coverage
Cover apex and all subdomains under a single high-performance ECDSA certificate.
💻 Live Output Simulation
$ cflare cert create namishkumar.in -o ./certs ✔ Generated 256-bit ECDSA private key ✔ Requested 15-year Origin CA certificate from Cloudflare... ✔ Certificate issued successfully: ID: 72819284719283749182 Expires: 2041-10-15 (15 years) Hostnames: namishkumar.in, *.namishkumar.in 📁 Saved ./certs/cert.pem and ./certs/key.pem