Use an origin certificate so the connection from Cloudflare to CloudPanel/NGINX is encrypted and can be validated in Full (strict) mode.
The public site should load over HTTPS with Cloudflare set to Full (strict) and no 526 error.
Step-by-step
Create an Origin CA certificate
In Cloudflare, open SSL/TLS → Origin Server and create a certificate for the hostnames you serve, such as example.com and *.example.com. Save the private key immediately; treat it like a password.
Open the site SSL/TLS settings in CloudPanel
Select the website in CloudPanel, open SSL/TLS, and choose the option to import a certificate.
Paste the private key and certificate
Place the Cloudflare private key in the private-key field and the Origin CA certificate in the certificate field. Add the appropriate chain only if CloudPanel requires it.
Enable Full (strict)
In Cloudflare SSL/TLS settings, use Full (strict) after the origin certificate is installed and the origin answers on TCP 443.
Test HTTPS
Open the site through its normal proxied hostname. If you see error 526, verify that the origin certificate is unexpired and covers the exact requested hostname.
Understand direct-origin behavior
A Cloudflare Origin CA certificate is designed for Cloudflare-to-origin traffic. Browsers connecting directly to the origin IP may not trust it, which is expected.
The public site should load over HTTPS with Cloudflare set to Full (strict) and no 526 error.
Troubleshooting
If a command or screen differs from the lesson, stop and verify the version you are using before forcing a change.
What you learned
You now understand the purpose of this part of the system and have a concrete result you can verify before continuing to the next lesson.