Does it support ECC and PEM ssl certificates?

[insign]

on my docker file I put:

# Copy your own certs into the container
COPY ./cf_bs_ECC_cert.pem /etc/ssl/site/server.crt
COPY ./cf_bs_ECC_key.pem /etc/ssl/site/server.key

They was generated by Cloudflare to comunicate exclusively with Cloudflare proxy, but I think I shouldn't get this error in the browser accessing directly from the IP.

This site can’t provide a secure connection
207.246.87.251 sent an invalid response.
ERR_SSL_PROTOCOL_ERROR

The cert used are in PEM format and uses ECC instead of RSA.

[insign]

There is an extra cerf called "chain" or "origin root" but I don't know how to add it to the server, there is not documentation on the currently repo for this, and for sure I want to avoid change the easiness of user env variables over complete file configuration :|

Some additional doc: https://developers.cloudflare.com/ssl/origin-configuration/origin-ca/#cloudflare-origin-ca-root-certificate

[shinsenter]

Hi @insign,

Origin CA certificates allow you to encrypt traffic between Cloudflare and your origin web server and reduce origin bandwidth.

These certificates are only trusted by Cloudflare when connecting to your origin server. If you try to connect directly to your origin server through your browser (or if Cloudflare is paused or the DNS record is not proxied), you will see a warning.

Quoted:

Site visitors may see untrusted certificate errors if you pause or disable Cloudflare on subdomains that use Origin CA certificates. These certificates only encrypt traffic between Cloudflare and your origin server, not traffic from client browsers to your origin.

Origin CA certificates · Troubleshooting

This is expected behavior.

[shinsenter]

Not tested but if you have an intermediate certificate file (something like cf_bs_ECC_intermediate.pem), try this on your host machine before starting your container:

cat cf_bs_ECC_intermediate.pem >> cf_bs_ECC_cert.pem

※ Note: please make a backup of your cert files.

Then use your PEM files as described above.

COPY ./cf_bs_ECC_cert.pem /etc/ssl/site/server.crt
COPY ./cf_bs_ECC_key.pem /etc/ssl/site/server.key

[insign]

Thank you again.