config option noTLSVerify does not work

[ivanixgames]

Trying to get cloudflare tunnel to support https with a ssl cert in my server.
It seems from documentation that the noTLSVerify option in the config.yaml is what supposed to be used, but does not.
Can anyone confirm if ssl is indeed required or not?
Here is my config as i followed from a previous bug submission (#277)

-----------------
tunnel: mytunnel
credentials-file: /home/ubuntu/.cloudflared/xxxxxxxx.json

originRequest:
  noTLSVerify: true

ingress:
  - service: https://xx.xx.xx.xx:443
    hostname: my.sub.mydomain.com
  - service: http://xx.xx.xx.xx:80
    hostname:  my.sub.mydomain.com
  - service: http_status:404
------------------------------------------------
$ cloudflared tunnel run  mytunnel
 Comes up ok, no obvious errors or other.
 ------------------------------------------------
 In browser: 
 https://my.sub.mydomain.com
 displays
 --------------------------------------------
This site can’t provide a secure connection sub2.sub1.mydomain.com uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
-----------------------------------------

Also, I tried using an origin cert generated by cloudflare, it seems also not to be recognized.
Ultimately i was hoping to get wildcard supported but even specific hostname not working.

Anyone have any ideas?

[DevinCarr]

The noTLSVerify is only for (not)validating the certificate between cloudflared and your origin service.

The error that you are seeing: This site can’t provide a secure <domain>.com uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH. Is this error reported from cloudflared logs or your browser when attempting to connect to the endpoint?

[KianNH]

my.sub.mydomain.com

Cloudflare's Universal SSL does not cover subdomains this deep, it would only cover *.mydomain.com and mydomain.com

If you don't have Advanced Certificate Manager, this is the issue - it's not related to cloudflared.

[catfishlty]

@KianNH
Hi~
I have same issue with this error ERR_SSL_VERSION_OR_CIPHER_MISMATCH. As you said, I know that Cloudflare's SSL is not supported wildcard subdomain(ex. my.sub.mydomain.com), so I disable Cloudflare's Universal SSL.
As I thought, I want to setup SSL in my local server and make tunnel route the traffics to my server.
After some tests I found:
Network Access:
my.sub.mydomain.com -> http://127.0.0.1:80 : Access to http://my.sub.mydomain.com -> OK
my.sub.mydomain.com -> https://127.0.0.1:443 : Access to https://my.sub.mydomain.com -> Error

Local Access - Setup hosts file:
Access to https://my.sub.mydomain.com -> OK

ERR_SSL_VERSION_OR_CIPHER_MISMATCH shows in Chrome

My Infrastructure
User -> Public Network -> Cloudflare Tunnel -> Cloudflared App -> Nginx(set with SSL)

Can you help me with this problem? Thanks~

[ivanixgames]

@DevinCarr Sincere apologies for late reply.

The error

This site can’t provide a secure <domain>.com uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH.
Appears in the browser.

The server has a valid wildcard subdomain SSL cert from letsencypt using certbot.
The error goes away when I bypass the cloudflare proxy and DNS points directly to server.
So it either cloudflare proxy doesn't recognize the tlsv3 protocol coming from nginx server, or I cannot use my own valid SSL cert because cloudfare does not support wildcard subdomain deeper than one level, and as @KianNH states I must use Advanced Certificate Manager.