- Let Encrypt behind Cloudflare Tunnel
When you put your server behind Cloudflare Tunnel, the SSL certificate management is typically handled by Cloudflare rather than Let’s Encrypt directly. Cloudflare offers its own SSL/TLS certificates, which are managed and automatically renewed by Cloudflare.
When you enable the Cloudflare DNS mode proxy (orange cloud), the traffic between the client and Cloudflare is encrypted using Cloudflare’s SSL certificate. Cloudflare handles the SSL termination and then communicates with your server over the tunnel using its own certificate.
As a result, you don’t need to worry about renewing the Let’s Encrypt certificate on your server directly. Cloudflare will manage the SSL/TLS certificate for the domain and handle the renewal process automatically.
It’s worth noting that when using Cloudflare’s SSL certificate, the SSL handshake between the client and Cloudflare happens at the edge server, reducing the load on your server and potentially improving performance.