title: Configure NGINX + CloudFlare + SSL
body: <p>SO...</p>
  
  <p>I have a node application running on a server on port 8080 and I am trying to enabled it to work over SSL using NGINX and CloudFlare. Note the following...</p>
  
  <ol>
  <li>My host is running Ubuntu 16.04 LTS</li>
  <li>I am currently using CloudFlare's Universal SSL (free tier)</li>
  <li>I have my test host DNS setup as test.company.com</li>
  <li>I have copied the CloudFlare origin pull cert from <a href="https://blog.cloudflare.com/protecting-the-origin-with-tls-authenticated-origin-pulls/" rel="noreferrer">this</a> post to my test box's /etc/nginx/certs</li>
  </ol>
  
  <p>...my previous NGINX configuration looked like...</p>
  
  <pre><code>server {
      listen 80;
  
      location / {
          proxy_pass http://localhost:8080;
      }
  }
  </code></pre>
  
  <p>...it now looks like...</p>
  
  <pre><code># HTTP
  server {
    listen 80;
    listen [::]:80 default_server ipv6only=on;
    return 301 https://$host$request_uri;
  }
  
  # HTTPS
  server {
    listen 443;
    server_name test.company.com;
  
    ssl on;
    ssl_client_certificate /etc/nginx/certs/cloudflare.crt;
    ssl_verify_client on;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
    ssl_prefer_server_ciphers on;
  
    location / {
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-NginX-Proxy true;
      proxy_pass http://localhost:8080/;
      proxy_ssl_session_reuse off;
      proxy_set_header Host $http_host;
      proxy_cache_bypass $http_upgrade;
      proxy_redirect off;
    }
  }
  </code></pre>
  
  <p>...I followed the example <a href="https://support.cloudflare.com/hc/en-us/articles/204494148-Setting-up-NGINX-to-use-TLS-Authenticated-Origin-Pulls" rel="noreferrer">here</a> and the link it provides <a href="https://blog.cloudflare.com/protecting-the-origin-with-tls-authenticated-origin-pulls/" rel="noreferrer">here</a> and I'm skeptical that everything above is required (I'm a minimalist). Whenever I run <code>sudo nginx -t</code> I still get errors around ssl_certificate and ssl_certificate_key not being specified. I cannot figure out how to download the require files from CloudFlare and from what I understand, I don't believe I should need to.</p>
  
  <p>If I try to re-use the CloudFlare origin pull cert as both the ssl_certificate and ssl_certificate_key, I get the error <code>nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/nginx/certs/cloudflare.crt") failed (SSL: error:0906D06C:PEM routines:PEM_read_bio:no start line:Expecting: ANY PRIVATE KEY error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:PEM lib)</code></p>
  
  <p>I am confident that it is possible to create my own self-signed certificate, but I am planning on using this strategy eventually to spin up production machines. Any help on pointing me in the right direction is much appreciated.</p>