Understand which Cloudflare SSL options encrypt HTTPS traffic between Cloudflare and the origin web server.
Overview
The SSL section of the Cloudflare SSL/TLS app contains several options that determine whether Cloudflare securely connects to your origin web server.
After reviewing the description of each SSL option, refer to our list of recommended SSL options depending on your origin web server SSL configuration:
Off disables HTTPS for your site visitors whereas Full(Strict) provides the most traffic security end-to-end.
Off
Off disables secure HTTPS connections between both visitors and Cloudflare and between Cloudflare and your origin web server. Visitors can only view your website over HTTP. Any connections attempted via HTTPS result in a HTTP 301 redirect to unencrypted HTTP.
Flexible
The Flexible SSL option allows a secure HTTPS connection between your visitor and Cloudflare, but forces Cloudflare to connect to your origin web server over unencrypted HTTP. An SSL certificate is not required on your origin web server and your visitors will still see the site as being HTTPS enabled.
Full
Full ensures a secure connection between both the visitor and your Cloudflare domain and between Cloudflare and your web server.
To avoid 525 errors, before enabling Full SSL option, configure your origin web server to allow HTTPS connections on port 443 and present either a self-signed SSL certificate, a Cloudflare Origin CA certificate, or a valid certificate purchased from a Certificate Authority.
Full (strict)
Full (strict) ensures a secure connection between both the visitor and your Cloudflare domain and between Cloudflare and your origin web server. Full (strict) support SSL hostname validation against CNAME targets.
Configure your origin web server to allow HTTPS connections on port 443 and present either a Cloudflare Origin CA certificate or a valid certificate purchased from a Certificate Authority. This certificate must be signed by a Certificate Authority that is trusted by Cloudflare, have a future expiration date, and cover the requested domain name (hostname).
Strict (SSL-Only Origin Pull)
Strict (SSL-Only Origin Pull) instructs Cloudflare's network to always connect to your origin web server using SSL/TLS encryption (HTTPS). The SSL certificate presented by the origin web server must be signed by a Certificate Authority that is trusted by Cloudflare, have a future expiration date, and cover the requested domain name (hostname).
SSL/TLS Recommender
To check if your domain is compatible with a more secure SSL/TLS mode, enable the SSL/TLS Recommender. The SSL/TLS Recommender checks for content differences in your site when served over HTTP and HTTPS. It also checks if your site is configured with a valid TLS certificate. Based on this and recursive crawls over encrypted and unencrypted connections, it recommends the mode that maximizes security while preserving content.
When enabled, the SSL/TLS Recommender sends the zone owner an email with an SSL/TLS mode recommendation if one is available. A "Recommended by Cloudflare" tag displays next to the recommended mode on the SSL/TLS page. If you do not receive an email, the recommendation is to keep the current mode. You are not required to use the recommendation. The Recommender runs periodically and sends notifications if new recommendations become available. The recommendation is never lower than your current SSL/TLS mode.
The SSL/TLS Recommender is not intended to resolve issues with website or domain functionality. The Recommender will not be able to complete its scan and show the "Recommended by Cloudflare" tag if
- the domain is not functional,
- you enable Cloudflare Workers® for your website,
- you block all bots, or
- there are any active SSL-specific Page Rules.
Related resources
Learn
- End-to-end HTTPS with Cloudflare - Part 1: conceptual overview
- End-to-end HTTPS with Cloudflare - Part 2: SSL certificates