I kept running into the same issue while deploying apps with Coolify behind Cloudflare.
Everything worked until SSL.
With Cloudflare proxy enabled, setting up proper SSL (Full Strict) on the origin was always a bit messy. Let’s Encrypt works, but it introduces extra steps in this setup — validation issues, temporary changes, or just more moving parts than needed.
Cloudflare already provides Origin CA certificates, which fit this use case better:
<ul>
<li>no validation challenge</li>
<li>long-lived certs (up to 15 years)</li>
<li>works cleanly with proxy enabled</li>
</ul>
The problem is the setup.
Each time I had to:
<ul>
<li>generate cert + key</li>
<li>copy to server</li>
<li>configure Traefik or Caddy</li>
<li>update DNS</li>
<li>switch SSL mode</li>
</ul>
Not complicated, but repetitive and easy to get wrong.
So I built a small CLI tool to automate this flow.
Certgun: <a href="https://github.com/takielias/certgun" target="_blank" rel="noopener nofollow">https://github.com/takielias/certgun</a>
**Blog Post : **<a href="https://docs.ebuz.xyz/blog/posts/why-i-built-certgun" target="_blank" rel="noopener nofollow">https://docs.ebuz.xyz/blog/posts/why-i-built-certgun</a>
What it does:
<ul>
<li>issues Cloudflare Origin certificates</li>
<li>deploys them over SSH</li>
<li>detects Traefik or Caddy and configures it</li>
<li>updates DNS records</li>
<li>sets SSL mode to Full (Strict)</li>
</ul>
Example:
certgun init
certgun add &lt;server-ip&gt; example. com
That’s it.
Right now it’s focused on self-hosted Coolify setups. Curious if others here ran into the same friction or have a better workflow for this.

Taki Elias

Certgun is a CLI tool that automates Cloudflare Origin CA certificate setup for self-hosted Coolify deployments. It addresses the repetitive manual steps required when using Cloudflare proxy with Full Strict SSL mode: generating certs, deploying over SSH, configuring Traefik or Caddy, updating DNS records, and setting the SSL mode. The tool reduces this to two commands: certgun init and certgun add <server-ip> <domain>.

Certgun – simplify Cloudflare SSL for Coolify