End-to-end HTTPS with Cloudflare - Part 3: SSL options

Avatar
Damon
Follow

Understand which Cloudflare SSL options encrypt HTTPS traffic between Cloudflare and the origin web server.

Overview

The SSL section of the Cloudflare Crypto app contains several options that determine whether Cloudflare securely connects to your origin web server. After reviewing the description of each SSL option, refer to our list of recommended SSL options depending on your origin web server SSL configuration:

Off disables HTTPS for your site visitors whereas Full(Strict) provides the most traffic security end-to-end.

If your origin web server either redirects HTTP traffic to HTTPS or HTTPS traffic to HTTP, redirect loop errors can occur for website visitors.

Off

cfssl_off.png

Off disables secure HTTPS connections between both visitors and Cloudflare and between Cloudflare and your origin web server. Visitors can only view your website over HTTP. Any connections attempted via HTTPS result in a HTTP 301 redirect to unencrypted HTTP.

Flexible

cfssl_flexible.png

The Flexible SSL option allows a secure HTTPS connection between your visitor and Cloudflare, but forces Cloudflare to connect to your origin web server over unencrypted HTTP. An SSL certificate is not required on your origin web server and your visitors will still see the site as being HTTPS enabled.

Flexible is not recommended if your website contains sensitive information. Use Flexible only as a last resort if you are unable to setup SSL at your origin web server.

Full

cfssl_full.png

Full ensures a secure connection between both the visitor and your Cloudflare domain and between Cloudflare and your web server.

The Full SSL option does not validate SSL certificate authenticity at the origin. A self-signed certificate is allowed at the origin web server.

To avoid 525 errors, before enabling Full SSL option, configure your origin web server to allow HTTPS connections on port 443 and present either a self-signed SSL certificate, a Cloudflare Origin CA certificate, or a valid certificate purchased from a Certificate Authority.

Full (strict)

cfssl_strict.png

Full(strict) ensures a secure connection between both the visitor and your Cloudflare domain and between Cloudflare and your origin web server. Configure your origin web server to allow HTTPS connections on port 443 and present either a Cloudflare Origin CA certificate or a valid certificate purchased from a Certificate Authority. This certificate must be signed by a Certificate Authority that is trusted by Cloudflare, have a future expiration date, and cover the requested domain name (hostname).

The Full(strict) SSL option checks for SSL certificate validity at the origin web server. A self-signed certificate cannot be used. A Cloudflare Origin CA certificate or valid certificate purchased from a Certificate Authority is required to avoid 526 errors.

Strict (SSL-Only Origin Pull)

Strict (SSL-Only Origin Pull) is only available for Enterprise zones.

Strict (SSL-Only Origin Pull) instructs Cloudflare's network to always connect to your origin web server using SSL/TLS encryption (HTTPS). The SSL certificate presented by the origin web server must be signed by a Certificate Authority that is trusted by Cloudflare, have a future expiration date, and cover the requested domain name (hostname). 

Additionally, Strict (SSL-Only Origin Pull) instructs Cloudflare to utilize Authenticated Origin Pulls.

Related resources

Learn

Troubleshoot

Was this article helpful?
101 out of 128 found this helpful
Not finding what you need?
Ask the Community   Submit a request

95% of questions can be answered using the search tool. This is the quickest way to get a response.

Popular questions: Why is my site slow, 522 errors, I'm expecting a spike in traffic

Powered by Zendesk