Trusting Cloudflare Origin CA Certificates in Coder on Kubernetes

Last updated: June 25, 2026

Applies to: Coder deployed on Kubernetes using Cloudflare Origin CA certificates

Summary

When deploying Coder on Kubernetes behind Cloudflare with Origin CA certificates, you may encounter health check errors:

EACSO3: get healthz endpoint: Get "https://your-coder-domain.com/healthz": tls: failed to verify certificate: x509: certificate signed by unknown authority

This occurs because Cloudflare Origin CA is not a publicly trusted CA. Unlike DigiCert or Let's Encrypt, the Cloudflare Origin CA root must be explicitly added to your trust store.

Cloudflare Origin CA Root Certificates

Download the appropriate root certificate for your key type:

RSA: origin_ca_rsa_root.pem
ECC: origin_ca_ecc_root.pem

Solution: Use Helm coder.certs (Recommended)

The Coder Helm chart provides coder.certs to mount CA certificates into the pod:

Download and create a Kubernetes secret:

curl -fsSL https://developers.cloudflare.com/ssl/static/origin_ca_rsa_root.pem -o cf-origin-root.pem
kubectl create secret generic cloudflare-origin-ca --from-file=cf-origin-root.pem

Configure Helm values:

coder:
  certs:
    secrets:
      - name: cloudflare-origin-ca
        key: cf-origin-root.pem

Verification

Verify your certificate against the Cloudflare Origin CA:

openssl verify -CAfile cf-origin-root.pem your-cert.pem
# Expected output: your-cert.pem: OK

VS Code Certificate Errors

If VS Code shows "Unable to verify the first certificate" when connecting to workspaces, see Error: VS Code Extension "Unable to Verify the First Certificate" for detailed guidance on NODE_EXTRA_CA_CERTS and template configuration.