All of the websites I manage use cPanel, which also offers free SSL certificates. However, some of these domains use Cloudflare for their DNS, and they also get their SSL certificates from Cloudflare itself.
For these websites, cPanel's AutoSSL feature normally fails at renewal time. I see several questions online that ask how to make sure AutoSSL works when Cloudflare is in the picture (and the solution require either editing the .htaccess file for the website, or temporarily disable Cloudflare's SSL so the AutoSSL feature can complete successfully).
My question is a different one: if I get an SSL certificate from Cloudflare already, do I even need cPanel's AutoSSL feature? Is there any scenario where I would benefit from making sure that cPanel's AutoSSL correctly renews all certificates anyway?


When you use cloudflare there are two connections to your website because Cloudflare acts as a proxy in the middle:
User ------> Cloudflare ------> Origin (cPanel)
Cloudflare will enable SSL between the user and Cloudflare but may leave the connection to the origin unencrypted:
User ======> Cloudflare ------> Origin
If you have SSL on the origin as well, both connections will be encrypted:
User ======> Cloudflare ======> Origin
You have several options for encrypting traffic to the origin:

  • Use AutoSSL to get a LetsEncrypt certificate. These certificates expires every few months but get auto-renewed and re-installed.
  • Get an origin certificate from CloudFlare that it trusts (but which users may not trust.) These certificates expire every 10 years and need to be manually installed.
  • Use a self signed certificate which doesn't allow you enable strict SSL mode at Cloudflare and could be vulnerable to a forgery attack.

AutoSSL is LetsEncrypt for cPanel. LetsEncrypt uses an automatic challenge response to verify that you are the owner of the domain:

  1. cPanel contacts LetsEncrypt and requests a certificate for a domain
  2. LetsEncrypt gives cPanel unique data to publish at a specific URL (under /.wellknown/acme-challenge/
  3. cPanel publishes the data
  4. LetsEncrypt validates that the data has been published, sees that you have control over domain, and gives cPanel the certificate.

When you have Cloudflare, all the requests first hit Cloudflare before hitting your website. Cloudflare should pass through the Acme Challenge requests and you should be able to get a LetsEncrypt certificate, even when Cloudflare is in the middle.