Cloudflare DNS and AutoSSL requires a very specific workflow

cPanel AutoSSL checks domain validation by trying to resolve server files via HTTP. Cloudflare’s proxy intercepts this and blocks it.

The solution is to temporarily unproxy the A and www record Cloudflare DNS using following steps:

  1. Log into your Cloudflare Dashboard and select your domain.Navigate to DNS > Records.
  2. Locate your root A record (e.g., @) and your www record.
  3. Click the orange proxied cloud icon and switch it to DNS Only (gray cloud).
  4. (Optional) If you use an Always Use HTTPS page rule in Cloudflare, disable it temporarily.

Then run Cpanel AutoSSL on the account on the server.

Once the SSL is issued on your server for the account and files are on the new host, you must update the records in Cloudflare to point to your server. i.e. update the records A and www records pointing to your server IP at Cloudflare DNS

Click the gray clouds to turn them back to Proxied (orange) if you want to use Cloudflare’s security and CDN features.

Make sure to Set the encryption mode to Full (Strict) to ensure end-to-end encryption between Cloudflare and your server.