A flux of cosmic rays (CRs) propagating through a diffuse ionized gas can excite MHD waves, thus generating magnetic disturbances. We propose a generic model of CR penetration into molecular clouds through their diffuse envelopes, and identify the leading physical processes controlling their transport on the way from a highly ionized interstellar medium to the dense interior of the cloud. The model allows us to describe a transition between a free streaming of CRs and their diffusive propagation, determined by the scattering on the self-generated disturbances. A self-consistent set of equations, governing the diffusive transport regime in an envelope and the MHD turbulence generated by the modulated CR flux, is characterized by two dimensionless numbers. It is shown that different mechanisms can lead to the onset of the diffusive regime and result in a universal energy spectrum of the modulated CRs. Implications of the results for several fundamental astrophysical problems are briefly discussed.