Right, so I fixed it for OP.
For others who've come here with the same issue, below is the solution.
//
So Cloudflare partners with 4 SSL Authorities to issue a free universal certificate to domains proxied through Cloudflare. These authorities are -
- DigiCert
- GlobalSign
- Let’s Encrypt
- Sectigo (formerly Comodo)
Source
Now with DigiCert, Cloudflare SSL is white-labelled. Looks a little like this
Rich (BB code):
Common name: sni.cloudflaressl.com
SANs: domain.com, sni.cloudflaressl.com, *.domain.com
Organization: Cloudflare, Inc.
Location: San Francisco, California, US
Valid from February 23, 2022 to February 23, 2023
Serial Number: xxx
Signature Algorithm: ecdsa-with-SHA256
Issuer: Cloudflare Inc ECC CA-3
As you can see the Issuer is listed as Cloudflare Inc. Now I am guessing, the tool that OP used -
https://checkforcloudflare.selesti.com/ - checks for this and then decides if the domain is actually using a Cloudflare certificate or not.
Now, these universal certificates are assigned at random. They can be from one of the 4 issuing authorities.
In this particular case, the certificate was indeed both valid and issued by Cloudflare.
As can be seen here -
As you can see, the certificate has been issued by Let's Encrypt - but is managed and auto-renewed by Cloudflare.
However, this is a problem for the above tool. As the name of the Issuer changes.
Also, as you're probably aware - Let's Encrypt only issues certificates valid for 3 months.
To mitigate this, you have to change your issuing authority.
To do this the easiest way is to request a change of authority via the Cloudflare API using
certificate_authority field of Cloudflare API -
Source //
API Source
To do this, you'll need the following
1.
Your Zone ID - You can get this by going to the Overview page of your domain and checking out the Zone ID in the column on the right hand side.
2.
Your Cloudflare email
3.
Your Cloudflare Global API Key - You can get this by going to
User Profile > API Token and scrolling down.
Then all you need to do is send a
curl request to the API with the details filled in. Below is the format
Bash:
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/[zone_id]/ssl/universal/settings" \
-H "Content-Type: application/json" \
-H "X-Auth-Email: [YOUR-EMAIL-ADDRESS]" \
-H "X-Auth-Key: [YOUR-GLOBAL-API-KEY]" \
--data '{"certificate_authority": "digicert"}'
You should receive the following response
JSON:
{
“result”: {
“enabled”: true,
“certificate_authority”: “digicert”
},
“success”: true,
“errors”: ,
“messages”:
}
That's it. Now go to the
Cloudflare Dashboard > Edge Certificates and Disable the Universal Certificate, then re-enable it in a few seconds and you'll have a Digicert/Cloudflare SSL.
(Wrote this rapidly, please excuse typos and/or brevity)
Cheers
