Understanding Cloudflare

​

DNS-only setup

1. Point your domain to your Fly.io app using an AAAA record for the IPv6 address and an A record for the IPv4 address.
2. Alternatively, use a CNAME record pointing to your app’s unique target, shown in your certificate setup instructions.
3. Disable the Cloudflare proxy (select “grey cloud”) for these records.
4. SSL certificates will be handled by Fly.io automatically using Let’s Encrypt.

​

CDN proxy setup (“orange cloud”)

​

Recommended setup

1. Add your domain to your Fly app:

fly certs add example.com

2. Add a _fly-ownership TXT record in Cloudflare DNS. Run fly certs setup to see the required record:

fly certs setup example.com

3. Configure your DNS records in Cloudflare:
   • Add an A record pointing to your Fly app’s IPv4 address.
   • Add an AAAA record pointing to your Fly app’s IPv6 address.
   • Alternatively, use a CNAME record pointing to your app’s .fly.dev target.
   • Enable the Cloudflare proxy (orange cloud) for these records.
4. Set SSL mode in Cloudflare to Full (strict).
5. Enable Always Use HTTPS in Cloudflare (recommended).

​

Using a Cloudflare Origin Certificate

1. Generate a Cloudflare Origin Certificate in the Cloudflare dashboard:
   • Go to SSL/TLS > Origin Server > Create Certificate.
   • Choose the hostnames to cover (for example, example.com and *.example.com).
   • Choose a validity period (Cloudflare offers up to 15 years).
   • Keep the page open — Cloudflare only shows the private key once.
2. Import the certificate to Fly.io in your app dashboard under Certificates. You can paste the certificate and private key directly from Cloudflare. Alternatively, save them as files and use the CLI:

fly certs import example.com --fullchain cert.pem --private-key key.pem
fly certs import "*.example.com" --fullchain cert.pem --private-key key.pem

3. Add the _fly-ownership TXT record shown in the certificate setup details, if you haven’t already set one up.
4. Configure your DNS records and Cloudflare SSL mode as described in the recommended setup above.

​

Common issues to watch for

​

General issues

• Always use “Full (strict)” in Cloudflare when connecting to Fly.io. Using “Flexible” mode may cause redirect loops.
• Only one application should manage certificates for a subdomain or apex domain. Using more than one can cause conflicts.

​

ACME-specific issues

• Check that your domain allows Let’s Encrypt with a CAA record like:

   example.com.  CAA  0 issue "letsencrypt.org"

• Let’s Encrypt has rate limits. Check the certificate status tab in the Fly.io dashboard if issuance fails.
• DNS-01 certificates will conflict with Cloudflare Universal SSL. This happens when Cloudflare’s Universal SSL automatically inserts hidden ACME challenge TXT records that don’t appear in your DNS dashboard. These ghost records interfere with Let’s Encrypt’s validation process. The best choice in this situation is to import a Cloudflare Origin Certificate instead.

​

Custom certificate issues

• Unlike Let’s Encrypt certificates, which renew automatically, custom certificates must be manually renewed and re-imported before they expire. Cloudflare Origin Certificates can be issued with long validity periods (up to 15 years), but you should still track expiry.

​

Tools for debugging

• fly certs check <hostname>: Check ownership TXT status, custom certificate status, and ACME certificate status all in one place. This is the best starting point for debugging.
• crt.sh: Check issued certificates.
• DNSChecker: Confirm DNS propagation.
• Let’s Debug: Analyze Let’s Encrypt certificate validation issues.
• dig: Inspect DNS records from the command line.

fly certs check your-app.example.com

dig AAAA your-app.example.com

dig TXT _fly-ownership.your-app.example.com

​

Related topics

• Custom domain guide
• Certificates API reference
• flyctl certs commands
• fly certs import reference