Cloudflare Origin certificate on Nginx

When your site goes through the Cloudflare proxy (orange cloud), visitors get Cloudflare's certificate. An Origin certificate also encrypts the path from Cloudflare to your server. With it you can use the Full (strict) SSL mode without Let's Encrypt and without renewals.

Create the certificate

In Cloudflare open SSL/TLS → Origin Server and click Create Certificate. Keep the RSA key and the suggested hostnames (yourdomain.com and *.yourdomain.com) and click Create.
Save the keys on the server

Cloudflare shows the Origin Certificate and the Private key. The private key is shown only once, so save both now. Connect to your server over SSH and create the files:
bash
```
mkdir -p /etc/ssl/cloudflare
nano /etc/ssl/cloudflare/yourdomain.com.pem
```
Paste the certificate, save, then do the same for the key:
bash
```
nano /etc/ssl/cloudflare/yourdomain.com.key
chmod 600 /etc/ssl/cloudflare/yourdomain.com.key
```
Use the certificate in Nginx

In the site configuration, in the server block with listen 443 ssl, replace the certificate lines:
nginx
```
ssl_certificate     /etc/ssl/cloudflare/yourdomain.com.pem;
ssl_certificate_key /etc/ssl/cloudflare/yourdomain.com.key;
```
Test and reload Nginx
bash
```
nginx -t && systemctl reload nginx
```
Set the SSL mode in Cloudflare

Open SSL/TLS → Overview and choose Full (strict).