Keep origin certificate validation while troubleshooting cloudflared

Distinguish an origin certificate name mismatch from an untrusted issuer before changing tunnel TLS settings.

Source facts

Cloudflare’s troubleshooting guide describes different x509 failures between cloudflared and an HTTPS origin. A certificate valid for a different name calls for checking the expected server name, including originServerName. An unknown-authority error calls for reviewing trust, with caPool available for the relevant CA material. The guide also describes noTLSVerify as disabling certificate verification; that setting changes what cloudflared validates.

Source: Cloudflare — Tunnel troubleshooting.

Applicability

This article concerns the tunnel-to-origin HTTPS connection. Record the exact error and origin service before applying a remedy to another TLS connection in the request path.

DSE recommendation

DSE recommends collecting the origin address, configured expected name, certificate names, issuer chain, validity period, and tunnel configuration in a sanitized diagnostic record. Correct the mismatch or trust configuration through the approved certificate process. Verify the CA through a trusted administrative channel before installing it. Keep certificate validation enabled in the accepted configuration rather than closing the issue after a bypass makes the page load. Preserve the previous configuration and a rollback path for the change window.

Verification

Repeat the application transaction with validation enabled, then confirm that the original x509 error is resolved. Where safely testable, verify rejection of an intentionally mismatched test certificate in an isolated environment. Record the final name and trust settings without publishing private certificate keys.

Official reference

Cloudflare — Tunnel troubleshooting. Reviewed October 14, 2026.