Stuck with the pfSense ACME Cloudflare invalid domain error? Our Server Support team can help you with your questions and concerns.

How to fix pfSense ACME Cloudflare invalid domain error

Some of our customers who use pfSense with ACME and Cloudflare have been coming across an invalid domain error message when they attempt to renew or obtain an SSL certificate. In other words, the ACME package is unable to validate the domain with Let’s Encrypt since it is proxied via Cloudflare.

Fortunately, our experts have a quick solution up their sleeve. Before we begin, let’s take a look at the root cause behind this issue.

According to our experts, Let’s Encrypt’s validation process relies on HTTP challenges to ensure that we control the domain we are requesting a certificate for. However, when the domain is proxied through Cloudflare, Let’s Encrypt sees the Cloudflare server’s IP address instead of our own. This causes the validation to fail. We can easily fix this issue by either of the following methods:

• DNS Validation

  Rather than relying on HTTP validation, we can use DNS validation to verify your domain ownership and avoid the invalid domain error. This method includes adding a TXT record to the Cloudflare DNS settings that has a randomly generated validation code by Let’s Encrypt.

  The ACME package checks the DNS records to confirm the code before issuing the SSL certificate. However, we need to have API access to our Cloudflare account to use this method.
• Cloudflare API Validation:

  Alternatively, we can try the Cloudflare API Validation method. This involves creating a temporary DNS record for the validation process with Cloudflare API. After that, Let’s Encrypt checks the record and issues the SSL certificate if it passes. The ACME package automates this process if we offer our Cloudflare API credentials.

Regardless of which method we choose to resolve the invalid domain error, we have to configure pfsense’s ACME package with the corresponding validation method to successfully renew or get new SSL certificates for our domain.

[Need assistance with a different issue? Our team is available 24/7.]

Conclusion

To sum up, our Support Techs demonstrated two different ways to resolve the pfSense ACME Cloudflare invalid domain error.