# Plan direct-access behavior before using Cloudflare Origin CA certificates

> A certificate trusted by Cloudflare is not necessarily trusted by a visitor connecting directly.

- Canonical URL: https://update.dsesecurity.com/updates/plan-direct-access-behavior-before-using-cloudflare-origin-ca-certificates/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:17:03+00:00
- Modified: 2026-10-20T18:34:37+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A certificate trusted by Cloudflare is not necessarily trusted by a visitor connecting directly.

## Potentially affected

This concerns Cloudflare Origin CA, not a publicly trusted visitor-facing certificate or a client certificate for authenticated origin requests.

## DSE recommendation

DSE recommends deciding whether emergency direct access is an intended recovery path before selecting the issuer.

## Article

A certificate trusted by Cloudflare is not necessarily trusted by a visitor connecting directly.

## Source facts

Cloudflare documents Origin CA certificates for the connection between its proxy and an origin. It warns that pausing Cloudflare or disabling proxying can expose visitors to untrusted-certificate errors because ordinary browsers do not use that origin-only trust model. The source also states that Origin CA expiry notifications are not currently sent, requiring independent inventory or monitoring.

Source: [Cloudflare — Cloudflare origin CA](https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/).

## Applicability

This concerns Cloudflare Origin CA, not a publicly trusted visitor-facing certificate or a client certificate for authenticated origin requests.

## DSE recommendation

DSE recommends deciding whether emergency direct access is an intended recovery path before selecting the issuer. If it is required, prepare an appropriate publicly trusted certificate or another supported recovery method rather than assuming proxy removal is transparent. Track origin certificate expiry independently and assign a renewal owner. Keep the private key outside public web paths and do not copy it into support evidence. Mark emergency direct access as supported, deliberately unavailable, or unresolved in the recovery plan. Ask the website owner to demonstrate the chosen recovery path without trust warnings. Include expiry ownership in that same review so an origin-only certificate is not omitted from the normal renewal inventory.

## Verification

Inspect the origin certificate and test the normal proxied website path. In an isolated or controlled recovery rehearsal, verify the planned direct-access method with normal trust validation and the correct hostname. Confirm the expiry-monitoring path reaches the responsible team, recording certificate metadata without exposing key material or disabling browser warnings.

## Official reference

[Cloudflare — Cloudflare origin CA](https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/). Reviewed October 20, 2026.

## Primary reference

- Name: Cloudflare — Cloudflare origin CA
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Plan direct-access behavior before using Cloudflare Origin CA certificates,” DSE Security, https://update.dsesecurity.com/updates/plan-direct-access-behavior-before-using-cloudflare-origin-ca-certificates/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.