Cloudflare故障排除指南：系统化诊断重定向循环、DNS与SSL证书问题

cloudflare-troubleshooting by daymade/claude-code-skills

178 周安装量

784 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/daymade/claude-code-skills --skill cloudflare-troubleshooting

云服务开发运维网站优化

🇨🇳中文介绍

Cloudflare 故障排除

核心原则

基于证据调查，而非假设。 在诊断问题之前，务必查询 Cloudflare API 以检查实际配置。此技能的价值在于系统化的调查方法，而非预设的解决方案。

调查方法

1. 收集凭证

向用户请求：

域名
Cloudflare 账户邮箱
Cloudflare 全局 API 密钥（或 API 令牌）

全局 API 密钥位置：Cloudflare 控制面板 → 我的个人资料 → API 令牌 → 查看全局 API 密钥

2. 获取区域信息

任何 Cloudflare 故障排除的第一步 - 获取区域 ID：

curl -s -X GET "https://api.cloudflare.com/client/v4/zones?name=<domain>" \
  -H "X-Auth-Email: <email>" \
  -H "X-Auth-Key: <api_key>" | jq '.'

从 result[0].id 中提取 zone_id 用于后续的 API 调用。

3. 系统化调查

对于每个问题，在下结论前先收集证据。使用 Cloudflare API 检查：

当前配置状态
最近的更改（如果有审计日志）
可能产生交互的相关设置

常见调查模式

重定向循环 (ERR_TOO_MANY_REDIRECTS)

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

源服务器错误 (502/503/504)

检查源站是否可达：

curl -I -H "Host: <domain>" https://<origin_ip>

检查 DNS 记录是否指向正确的源站：

curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records" \
  -H "X-Auth-Email: email" \
  -H "X-Auth-Key: key"

检查负载均衡器配置（如果适用）：

curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/load_balancers" \
  -H "X-Auth-Email: email" \
  -H "X-Auth-Key: key"

检查防火墙规则：

curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/firewall/rules" \
  -H "X-Auth-Email: email" \
  -H "X-Auth-Key: key"

当遇到上述未涵盖的问题时，请查阅 Cloudflare API 文档：

浏览 API 参考： https://developers.cloudflare.com/api/
使用问题关键词搜索相关端点
检查 API 模式以了解可用操作
首先使用 GET 请求进行测试以了解数据结构
在确认方法后使用 PATCH/POST 进行更改

探索新 API 的模式：

# 列出区域的可用设置
curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/settings" \
  -H "X-Auth-Email: email" \
  -H "X-Auth-Key: key"

查阅 references/api_overview.md 以了解：

按类别组织的常用端点
请求/响应模式
身份验证模式
速率限制和错误处理

查阅 references/ssl_modes.md 以了解：

SSL/TLS 模式的详细说明
平台兼容性
安全影响

查阅 references/common_issues.md 以了解：

问题模式和症状
调查清单
平台特定说明

基于证据的调查

先查询再假设 - 使用 API 检查实际状态
收集多个数据点 - 交叉引用设置
检查相关配置 - 设置通常会相互影响
外部验证 - 使用 dig/curl 确认
增量测试 - 一次只做一个更改

解析 JSON 响应 - 使用 jq 或 python 以提高可读性
检查成功字段 - 响应中的 "success": true/false
优雅地处理错误 - 读取响应中的 errors 数组
遵守速率限制 - Cloudflare API 有限制
使用适当的方法：
- GET：检索信息
- PATCH：更新设置
- POST：创建资源 / 触发操作
- DELETE：删除资源

首先收集证据 - 了解当前状态
确定根本原因 - 不要猜测
应用针对性修复 - 仅更改需要的内容
如果需要则清除缓存 - 特别是 SSL/重定向更改
验证修复 - 重新查询 API 以确认
告知用户等待时间：
- 边缘服务器传播：30-60 秒
- DNS 传播：最多 48 小时
- 浏览器缓存：需要手动清除

切勿在输出中记录 API 密钥
如果用户在公共上下文中共享凭证，请发出警告
推荐使用具有范围权限的 API 令牌，而非全局 API 密钥
调查时使用只读操作

1. 收集：域名、邮箱、API 密钥
2. 通过 zones API 获取 zone_id
3. 调查：
   - 查询相关 API 以获取证据
   - 检查多个相关设置
   - 使用外部工具验证 (dig, curl)
4. 分析证据以确定根本原因
5. 通过适当的 API 端点应用修复
6. 如果配置更改影响内容交付，则清除缓存
7. 通过 API 查询和外部测试验证修复
8. 告知用户解决方案和任何必要的操作

示例：完整调查

当用户报告"网站显示 ERR_TOO_MANY_REDIRECTS"时：

# 1. 获取区域 ID
curl -s -X GET "https://api.cloudflare.com/client/v4/zones?name=example.com" \
  -H "X-Auth-Email: user@example.com" \
  -H "X-Auth-Key: abc123" | jq '.result[0].id'

# 2. 检查 SSL 模式（重定向循环的主要怀疑对象）
curl -s -X GET "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/ssl" \
  -H "X-Auth-Email: user@example.com" \
  -H "X-Auth-Key: abc123" | jq '.result.value'

# 如果返回 "flexible" 且源站是 GitHub Pages/Netlify/Vercel：

# 3. 通过更改为 "full" 来修复
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/ssl" \
  -H "X-Auth-Email: user@example.com" \
  -H "X-Auth-Key: abc123" \
  -H "Content-Type: application/json" \
  --data '{"value":"full"}'

# 4. 清除缓存
curl -X POST "https://api.cloudflare.com/client/v4/zones/ZONE_ID/purge_cache" \
  -H "X-Auth-Email: user@example.com" \
  -H "X-Auth-Key: abc123" \
  -d '{"purge_everything":true}'

# 5. 告知用户：等待 60 秒，清除浏览器缓存，重试

捆绑的脚本 (scripts/check_cloudflare_config.py, scripts/fix_ssl_mode.py) 可用作：

调查模式的参考实现
当 Python 可用时的快速诊断工具
程序化 API 使用的示例

然而，为了灵活性和透明度，首选通过 Bash/curl 直接进行 API 调用。脚本不应限制能力 - 在方便时使用它们，但在需要时使用原始 API 调用以处理：

不熟悉的场景
边缘情况
学习/调试
脚本未涵盖的操作

调查方法和 API 知识是核心技能，而非脚本。

🇺🇸English

Cloudflare Troubleshooting

Core Principle

Investigate with evidence, not assumptions. Always query Cloudflare API to examine actual configuration before diagnosing issues. The skill's value is the systematic investigation methodology, not predetermined solutions.

Investigation Methodology

1. Gather Credentials

Request from user:

Domain name
Cloudflare account email
Cloudflare Global API Key (or API Token)

Global API Key location: Cloudflare Dashboard → My Profile → API Tokens → View Global API Key

2. Get Zone Information

First step for any Cloudflare troubleshooting - obtain the zone ID:

curl -s -X GET "https://api.cloudflare.com/client/v4/zones?name=<domain>" \
  -H "X-Auth-Email: <email>" \
  -H "X-Auth-Key: <api_key>" | jq '.'

Extract zone_id from result[0].id for subsequent API calls.

3. Investigate Systematically

For each issue, gather evidence before making conclusions. Use Cloudflare API to inspect:

Current configuration state
Recent changes (if audit log available)
Related settings that might interact

Common Investigation Patterns

Redirect Loops (ERR_TOO_MANY_REDIRECTS)

Evidence gathering sequence:

Check SSL/TLS mode:

curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/settings/ssl" \
  -H "X-Auth-Email: email" \
  -H "X-Auth-Key: key"

Look for: result.value - tells current SSL mode

Check Always Use HTTPS setting:

curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/settings/always_use_https" \
  -H "X-Auth-Email: email" \
  -H "X-Auth-Key: key"

Check Page Rules for redirects:

curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/pagerules" \
  -H "X-Auth-Email: email" \
  -H "X-Auth-Key: key"

Look for: forwarding_url or always_use_https actions

Test origin server directly (if possible):

curl -I -H "Host: <domain>" https://<origin_ip>

Diagnosis logic:

SSL mode "flexible" + origin enforces HTTPS = redirect loop
Multiple redirect rules can conflict
Check browser vs curl behavior differences

Fix:

curl -X PATCH "https://api.cloudflare.com/client/v4/zones/{zone_id}/settings/ssl" \
  -H "X-Auth-Email: email" \
  -H "X-Auth-Key: key" \
  -H "Content-Type: application/json" \
  --data '{"value":"full"}'

Purge cache after fix:

curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone_id}/purge_cache" \
  -H "X-Auth-Email: email" \
  -H "X-Auth-Key: key" \
  -d '{"purge_everything":true}'

DNS Issues

Evidence gathering:

List DNS records:

curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records" \
  -H "X-Auth-Email: email" \
  -H "X-Auth-Key: key"

Check external DNS resolution:
```
dig <domain>
dig @8.8.8.8 <domain>
```

Check DNSSEC status:

curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/dnssec" \
  -H "X-Auth-Email: email" \
  -H "X-Auth-Key: key"

Look for:

Missing A/AAAA/CNAME records
Incorrect proxy status (proxied vs DNS-only)
TTL values
Conflicting records

SSL Certificate Errors

Evidence gathering:

Check SSL certificate status:

curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/ssl/certificate_packs" \
  -H "X-Auth-Email: email" \
  -H "X-Auth-Key: key"

Check origin certificate (if using Full Strict):

openssl s_client -connect <origin_ip>:443 -servername <domain>

Check SSL settings:
- Minimum TLS version
- TLS 1.3 status
- Opportunistic Encryption

Common issues:

Error 526: SSL mode is "strict" but origin cert invalid
Error 525: SSL handshake failure at origin
Provisioning delay: Wait 15-30 minutes for Universal SSL

Origin Server Errors (502/503/504)

Evidence gathering:

Check if origin is reachable:

curl -I -H "Host: <domain>" https://<origin_ip>

Check DNS records point to correct origin:

curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records" \
  -H "X-Auth-Email: email" \
  -H "X-Auth-Key: key"

Review load balancer config (if applicable):

curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/load_balancers" \
  -H "X-Auth-Email: email" \
  -H "X-Auth-Key: key"

Check firewall rules:

curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/firewall/rules" \
  -H "X-Auth-Email: email" \
  -H "X-Auth-Key: key"

Learning New APIs

When encountering issues not covered above, consult Cloudflare API documentation:

Browse API reference: https://developers.cloudflare.com/api/
Search for relevant endpoints using issue keywords
Check API schema to understand available operations
Test with GET requests first to understand data structure
Make changes with PATCH/POST after confirming approach

Pattern for exploring new APIs:

# List available settings for a zone
curl -X GET "https://api.cloudflare.com/client/v4/zones/{zone_id}/settings" \
  -H "X-Auth-Email: email" \
  -H "X-Auth-Key: key"

API Reference Overview

Consult references/api_overview.md for:

Common endpoints organized by category
Request/response schemas
Authentication patterns
Rate limits and error handling

Consult references/ssl_modes.md for:

Detailed SSL/TLS mode explanations
Platform compatibility
Security implications

Consult references/common_issues.md for:

Issue patterns and symptoms
Investigation checklists
Platform-specific notes

Best Practices

Evidence-Based Investigation

Query before assuming - Use API to check actual state
Gather multiple data points - Cross-reference settings
Check related configurations - Settings often interact
Verify externally - Use dig/curl to confirm
Test incrementally - One change at a time

API Usage

Parse JSON responses - Use jq or python for readability
Check success field - "success": true/false in responses
Handle errors gracefully - Read errors array in responses
Respect rate limits - Cloudflare API has limits
Use appropriate methods:
- GET: Retrieve information
- PATCH: Update settings
- POST: Create resources / trigger actions
- DELETE: Remove resources

Making Changes

Gather evidence first - Understand current state
Identify root cause - Don't guess
Apply targeted fix - Change only what's needed
Purge cache if needed - Especially for SSL/redirect changes
Verify fix - Re-query API to confirm
Inform user of wait times:
- Edge server propagation: 30-60 seconds
- DNS propagation: Up to 48 hours
- Browser cache: Requires manual clear

Security

Never log API keys in output
Warn if user shares credentials in public context
Recommend API Tokens with scoped permissions over Global API Key
Use read-only operations for investigation

Workflow Template

1. Gather: domain, email, API key
2. Get zone_id via zones API
3. Investigate:
   - Query relevant APIs for evidence
   - Check multiple related settings
   - Verify with external tools (dig, curl)
4. Analyze evidence to determine root cause
5. Apply fix via appropriate API endpoint
6. Purge cache if configuration change affects delivery
7. Verify fix via API query and external testing
8. Inform user of resolution and any required actions

Example: Complete Investigation

When user reports "site shows ERR_TOO_MANY_REDIRECTS":

# 1. Get zone ID
curl -s -X GET "https://api.cloudflare.com/client/v4/zones?name=example.com" \
  -H "X-Auth-Email: user@example.com" \
  -H "X-Auth-Key: abc123" | jq '.result[0].id'

# 2. Check SSL mode (primary suspect for redirect loops)
curl -s -X GET "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/ssl" \
  -H "X-Auth-Email: user@example.com" \
  -H "X-Auth-Key: abc123" | jq '.result.value'

# If returns "flexible" and origin is GitHub Pages/Netlify/Vercel:

# 3. Fix by changing to "full"
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/ZONE_ID/settings/ssl" \
  -H "X-Auth-Email: user@example.com" \
  -H "X-Auth-Key: abc123" \
  -H "Content-Type: application/json" \
  --data '{"value":"full"}'

# 4. Purge cache
curl -X POST "https://api.cloudflare.com/client/v4/zones/ZONE_ID/purge_cache" \
  -H "X-Auth-Email: user@example.com" \
  -H "X-Auth-Key: abc123" \
  -d '{"purge_everything":true}'

# 5. Inform user: Wait 60 seconds, clear browser cache, retry

When Scripts Are Useful

The bundled scripts (scripts/check_cloudflare_config.py, scripts/fix_ssl_mode.py) serve as:

Reference implementations of investigation patterns
Quick diagnostic tools when Python is available
Examples of programmatic API usage

However, prefer direct API calls via Bash/curl for flexibility and transparency. Scripts should not limit capability - use them when convenient, but use raw API calls when needed for:

Unfamiliar scenarios
Edge cases
Learning/debugging
Operations not covered by scripts

The investigation methodology and API knowledge is the core skill, not the scripts.

Weekly Installs

132

Repository

daymade/claude-…e-skills

GitHub Stars

708

First Seen

Jan 21, 2026

Security Audits

Gen Agent Trust HubPass SocketPass SnykFail

Installed on

claude-code114

codex106

opencode106

gemini-cli104

cursor97

github-copilot94

Cloudflare故障排除指南：系统化诊断重定向循环、DNS与SSL证书问题

🇨🇳中文介绍

Cloudflare 故障排除

核心原则

调查方法

1. 收集凭证

2. 获取区域信息

3. 系统化调查

常见调查模式

重定向循环 (ERR_TOO_MANY_REDIRECTS)

相关 Skills

DNS 问题

SSL 证书错误

源服务器错误 (502/503/504)

学习新的 API

API 参考概览

最佳实践

基于证据的调查

API 使用

进行更改

安全性

工作流模板

示例：完整调查

何时使用脚本

🇺🇸English

Cloudflare Troubleshooting

Core Principle

Investigation Methodology

1. Gather Credentials

2. Get Zone Information

3. Investigate Systematically

Common Investigation Patterns

Redirect Loops (ERR_TOO_MANY_REDIRECTS)

DNS Issues

SSL Certificate Errors

Origin Server Errors (502/503/504)

Learning New APIs

API Reference Overview

Best Practices

Evidence-Based Investigation

API Usage

Making Changes

Security

Workflow Template

Example: Complete Investigation

When Scripts Are Useful

最新 Skills