跳到主要内容

Cloudflare and Reverse Proxies

  • For initial setup with Cloudflare DNS, point the wildcard A record to the CapRover server and choose DNS only (no Cloudflare proxy).

  • Confirm the dashboard and sample app work over HTTP before requesting certificates.

  • This lets CapRover's normal HTTP challenge reach its own NGINX service.

  • If you later turn on a proxy, verify its TLS mode, original Host header, WebSocket handling, cache behavior, and certificate renewal path.

  • A proxy terminating HTTPS does not automatically encrypt the connection to CapRover.

  • A redirect or challenge rule that prevents public requests to /.well-known/acme-challenge/ from reaching CapRover can break issuance or renewal.

For an upstream reverse proxy that owns host ports 80 and 443, see Reverse Proxy Scenarios. Configure and test the proxy's exact behavior before enabling forced HTTPS in both layers.

Cloudflare Universal SSL and nested app domains​

On a Cloudflare full DNS setup, Universal SSL covers example.com and first-level subdomains such as apps.example.com. It does not cover deeper hostnames such as my-app.apps.example.com.

  • If your CapRover root domain is apps.example.com, proxied app subdomains are two levels deep.
  • Use DNS only and let CapRover handle HTTPS at the origin, or configure Cloudflare Total TLS / advanced certificates for the deeper names.
  • On a Cloudflare partial CNAME setup, certificate behavior differs; follow Cloudflare's hostname coverage rules.

Check Cloudflare edge certificates separately from the certificates CapRover issues for the origin.