A flux of cosmic rays (CRs) propagating through a diffuse ionized gas can excite MHD waves, thus generating magnetic disturbances. We propose a generic model of CR penetration into molecular clouds through their diffuse envelopes, and identify the leading physical processes controlling their transport on the way from a highly ionized interstellar medium to the dense interior of the cloud. The model allows us to describe a transition between a free streaming of CRs and their diffusive propagation, determined by the scattering on the self-generated disturbances. A self-consistent set of equations, governing the diffusive transport regime in an envelope and the MHD turbulence generated by the modulated CR flux, is characterized by two dimensionless numbers. We demonstrate a remarkable mutual complementarity of different mechanisms leading to the onset of the diffusive regime, which results in a universal energy spectrum of the modulated CRs. In conclusion, we briefly discuss implications of our results for several fundamental astrophysical problems, such as the spatial distribution of CRs in the Galaxy as well as the ionization, heating, and chemistry in dense molecular clouds.