Skip to content
ChatterfyHelp Center
HomeGeneralCRMAI ManagerTrackerPlatformsFAQUpdate log
Tracker
Dashboards
Campaigns
Sources
Domains
Domains — custom domains
How to add a domain to Cloudflare
How to add a subdomain
How to Set Up SSL
How to add a domain in Chatterfy
Landings
Analytics
Cohorts
Leads
Integrations
  1. Tracker
  2. Domains
  3. How to Set Up SSL

How to Set Up SSL

SSL is an HTTPS certificate that encrypts the connection between the user's browser and the server. Without it, modern browsers show a scary “Not Secure” warning, and advertising platforms (Facebook,

Updated August 17, 20264 min
SSL is an HTTPS certificate that encrypts the connection between the user's browser and the server. Without it, modern browsers show a scary “Not Secure” warning, and advertising platforms (Facebook, Google) may reject ads with an http link as unsafe.
Cloudflare issues an SSL certificate automatically. You only need to enable the required mode — Flexible. After that, Cloudflare will generate Universal SSL in 5–15 minutes, and the domain will start opening via https://.
When to go to SSL settings
Immediately after How to add a domain to Cloudflare — this is a required step before launching traffic. If the domain opens with a “Not Secure” or “SSL Error” warning, check the SSL mode. If one subdomain is not working but the main domain is, the problem is usually not SSL (it is inherited), but it is worth checking. After any DNS changes, you sometimes need to recreate the SSL certificate.


How it works

  • — Off — no SSL. The domain works only over http. Not suitable — advertising platforms will block it.
  • — Flexible — browser ↔ Cloudflare over https, Cloudflare ↔ your server over http. This is the required mode for Tracker. The Tracker server does not have its own SSL certificate for your domain, but the Cloudflare proxy provides SSL to the user.
  • — Full — browser ↔ Cloudflare over https, Cloudflare ↔ server also over https (with a self-signed or valid certificate). Not suitable — Tracker servers do not have your certificate.
  • — Full (strict) — the same as Full, but with mandatory certificate validation. Not suitable.
To connect to Tracker, always select Flexible. Any other mode will cause a 525 / 526 / 522 error in Cloudflare and make the domain unavailable.


Setup steps

  1. 1

    Open SSL/TLS → Overview

    In Cloudflare, select your domain → SSL/TLS → Overview.
    
    SSL Overview
    SSL/TLS → Overview
    
    
  2. 2

    Select Flexible mode

    In the “Your SSL/TLS encryption mode” block, there are four options (Off / Flexible / Full / Full strict). Click Flexible. Cloudflare will apply it immediately and start issuing the certificate.
    
  3. 3

    Wait for the certificate to be issued

    Cloudflare issues SSL in 5–15 minutes (sometimes faster). You can track it in SSL/TLS → Edge Certificates. The certificate will appear in the list with the Active status.
    Edge Certificates
    SSL/TLS → Edge Certificates
    
  4. 4

    Check in the browser

    Open https://your-domain.com in the browser (you can use incognito mode to avoid cache). The padlock should be green or gray (not crossed out / no warning). If you see an error, wait a few more minutes.


Possible SSL errors

  • — ERR_SSL_PROTOCOL_ERROR / ERR_CONNECTION_RESET — usually Full / Full strict mode instead of Flexible. Switch to Flexible.
  • — Error 525 / 526 — Cloudflare cannot establish SSL with the destination servers. This is also a sign of the wrong mode. Enable Flexible.
  • — NET::ERR_CERT_AUTHORITY_INVALID — the certificate has not been issued (status is not Active). Wait 15 minutes; if nothing changes, recreate the mode (turn it off → turn on Flexible).
  • — The browser complains “Connection is not secure” — Cloudflare has not activated the domain yet (Pending status in Cloudflare). Wait until it becomes Active.


Use cases

Launching a new domain — affiliate arbitrage

A buyer purchased a new domain, added it to Cloudflare, and created a CNAME. They open it in the browser and see an SSL error. They go to SSL/TLS → Overview and see that the mode is Off (this is Cloudflare’s default for new domains). They switch it to Flexible. After 10 minutes, they check again — the domain opens over https.

Facebook ads rejected — performance marketing

The sales team added ads to Facebook with the link http://offer.example.com. Facebook rejects them: “non-secure URL”. They check — the domain opens over http, but https does not work. They enable Flexible mode, rerun the ads after 15 minutes — moderation passes.

After migration — bulk check

The team migrated from one hosting provider to Cloudflare for 5 domains. They went through each one: How to add a domain to Cloudflare, then SSL Flexible, then How to add a domain in Chatterfy. An hour later, all 5 domains are working over https and the campaigns are launched.
What to keep in mind
Use only Flexible mode — the others will cause errors. Cloudflare also has an Always Use HTTPS option (SSL/TLS → Edge Certificates) — we recommend enabling it, so even http requests are automatically redirected to https. SSL covers the root domain and all subdomains via Universal SSL — you do not need to configure them separately. If the root domain works but a subdomain shows an error, SSL usually has not covered the new subdomain yet (5–15 minutes). Do not use paid SSL — Cloudflare Free provides everything you need.


FAQ

Sometimes certificate issuance is delayed because of a CAA record check or a conflict with a previous certificate. Solutions:
  • — check DNS Records — make sure there are no CAA records that restrict the CA.
  • — switch SSL Off → wait a minute → switch back to Flexible.
  • — if it still does not work, contact Cloudflare support (on the free plan, they reply by email).

Also enable SSL/TLS → Edge Certificates → Always Use HTTPS = On. This will automatically redirect all http requests to https. Without this option, a user who types http:// will remain on http.

Cloudflare uses its own CA for Universal SSL (it is free and unlimited). You can install Let's Encrypt on your server, but in the Tracker scenario you do not have your own server for the domain — traffic goes through the Cloudflare proxy to nemo.chatterfy.ai. That is why the Cloudflare option is the only logical one.

Cloudflare renews Universal SSL automatically — no action is required from you. Certificates are issued for 90 days and renewed 30 days before expiration. No need to worry.

Universal SSL covers only domain.com and *.domain.com — that is, the root domain and first-level subdomains. For a.b.example.com (4th level), Universal SSL will not work. Solutions: use 3rd-level subdomains (a-b.example.com), enable Advanced Certificate Manager in Cloudflare (paid), or limit yourself to the 3rd level.


Related

Domains — custom domains
Connecting custom domains and subdomains via Cloudflare for tracking links, landing pages, and event tracking in Tracker. Tracker → Domains is an infrastructure section used to connect domains for cam
How to add a domain to Cloudflare
This guide is the first step in connecting a custom domain to Tracker. After this stage, the domain will use Cloudflare DNS and have a CNAME record pointing to Chatterfy servers. Next, you need to con
How to add a domain in Chatterfy
This step is the final one. By this point, the domain must be connected in Cloudflare ( ), SSL configured ( ), and the domain must be accessible via https without errors. Now, you need to add it withi
How to add a subdomain
Поддомен — это отдельный адрес внутри уже подключённого основного домена ( offer.example.com , promo.example.com ). Технически — это просто новая DNS-запись в зоне Cloudflare. Не нужно менять nameserv

Was this article helpful?

BackHow to add a subdomainNextHow to add a domain in Chatterfy

On this page

  • How it works
  • Setup steps
  • Possible SSL errors
  • Use cases
  • Launching a new domain — affiliate arbitrage
  • Facebook ads rejected — performance marketing
  • After migration — bulk check
  • FAQ
  • Related