title: How can I use Go's autocert package with CloudFlare?
body: <p>I tried running this example code from the autocert documentation, changing it to use my domain:</p>
  
  <pre class="lang-golang prettyprint-override"><code>package main
  
  import (
      "fmt"
      "log"
      "net/http"
  
      "golang.org/x/crypto/acme/autocert"
  )
  
  func main() {
      mux := http.NewServeMux()
      mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
          fmt.Fprintf(w, "Hello, TLS user! Your config: %+v", r.TLS)
      })
      log.Fatal(http.Serve(autocert.NewListener("mydomain.work"), mux))
  }
  </code></pre>
  
  <p>In the browser I saw a CloudFlare error saying <code>Error 525 SSL handshake failed</code>. The output of the Go program was</p>
  
  <pre><code>2020/02/27 00:44:10 http: TLS handshake error from 172.69.22.250:26624: acme/autocert: unable to satisfy "https://acme-v02.api.letsencrypt.org/acme/authz-v3/3031814088" for domain "mydomain.work": no viable challenge type found
  </code></pre>
  
  <p>The problem persisted when I turned off CloudFlare's Always Use HTTPS feature, which would have been blocking the http-01 challenge. It also persisted when I set TLS to Off in the CloudFlare console. I finally got it working by going back to NameCheap's Basic DNS.</p>
  
  <p>I like CloudFlare's functionality, so this leaves me wondering: how can I make Go's autocert package work with CloudFlare? Or is it unnecessary because I could just use a self-signed cert with CloudFlare's Full Encryption setting?</p>