Plan direct-access behavior before using Cloudflare Origin CA certificates

A certificate trusted by Cloudflare is not necessarily trusted by a visitor connecting directly.

Source facts

Cloudflare documents Origin CA certificates for the connection between its proxy and an origin. It warns that pausing Cloudflare or disabling proxying can expose visitors to untrusted-certificate errors because ordinary browsers do not use that origin-only trust model. The source also states that Origin CA expiry notifications are not currently sent, requiring independent inventory or monitoring.

Source: Cloudflare — Cloudflare origin CA.

Applicability

This concerns Cloudflare Origin CA, not a publicly trusted visitor-facing certificate or a client certificate for authenticated origin requests.

DSE recommendation

DSE recommends deciding whether emergency direct access is an intended recovery path before selecting the issuer. If it is required, prepare an appropriate publicly trusted certificate or another supported recovery method rather than assuming proxy removal is transparent. Track origin certificate expiry independently and assign a renewal owner. Keep the private key outside public web paths and do not copy it into support evidence. Mark emergency direct access as supported, deliberately unavailable, or unresolved in the recovery plan. Ask the website owner to demonstrate the chosen recovery path without trust warnings. Include expiry ownership in that same review so an origin-only certificate is not omitted from the normal renewal inventory.

Verification

Inspect the origin certificate and test the normal proxied website path. In an isolated or controlled recovery rehearsal, verify the planned direct-access method with normal trust validation and the correct hostname. Confirm the expiry-monitoring path reaches the responsible team, recording certificate metadata without exposing key material or disabling browser warnings.

Official reference

Cloudflare — Cloudflare origin CA. Reviewed October 20, 2026.