Навчання
Cloudflare SSL Modes: Flexible, Full, Full (Strict) and Origin Certificates
The mode does not change what visitors see — they always get HTTPS. It changes the leg between Cloudflare and your server, and Flexible leaves that leg unencrypted.
Запусти свіжий аудит DomainLens і використовуй звіт як список пріоритетів.
The connection has two legs
When Cloudflare proxies a site, there are two separate connections: the visitor to Cloudflare, and Cloudflare to your origin. The visitor leg is always HTTPS with a Cloudflare-managed certificate. The SSL mode controls only the second leg.
That is why a site can show a padlock while being served over plain HTTP behind the scenes — and why the setting matters more than it appears from the dashboard.
| Mode | Cloudflare → origin | Certificate validated? |
|---|---|---|
| Off | HTTP, and visitors get HTTP too | n/a |
| Flexible | Plain HTTP — unencrypted | No |
| Full | HTTPS | No — self-signed accepted |
| Full (strict) | HTTPS | Yes — must be valid and trusted |
| Strict (SSL-Only Origin Pull) | HTTPS with client certificate | Yes, both directions |
Why Flexible is a trap
Flexible mode means traffic between Cloudflare and your server crosses the internet unencrypted while visitors see a padlock. The security guarantee the padlock implies is not being met, and anyone positioned between Cloudflare and your origin can read or alter the traffic.
It also causes redirect loops routinely. If the origin redirects HTTP to HTTPS — which most do — Cloudflare arrives over HTTP, gets redirected to HTTPS, hands that back to the visitor, who returns through Cloudflare over HTTP again. The loop is infinite and the cause is invisible from the browser.
Full versus Full (strict)
Full encrypts the origin leg but accepts any certificate, including a self-signed one that has expired. That protects against passive eavesdropping but not against an attacker who can intercept and present their own certificate.
Full (strict) validates properly: the certificate must be valid, unexpired, and issued by a trusted authority or by Cloudflare's own origin CA. This is the correct setting for essentially every site, and the free origin certificate makes it achievable without cost.
# Generate in the dashboard: SSL/TLS -> Origin Server
# -> Create Certificate. Valid up to 15 years, and
# trusted by Cloudflare specifically.
# nginx
ssl_certificate /etc/ssl/cloudflare-origin.pem;
ssl_certificate_key /etc/ssl/cloudflare-origin.key;
# Note: this certificate is NOT trusted by browsers.
# It only works for traffic arriving through Cloudflare,
# which is the point — set Full (strict) alongside it.Symptoms and which mode causes them
The redirect loop is the one that generates most support requests, and the fix is always the same: move off Flexible. For the error codes themselves see Cloudflare 5xx errors , and for page-level HTTPS problems see mixed content .
- Redirect loop, ERR_TOO_MANY_REDIRECTS — Flexible mode against an origin that forces HTTPS.
- Error 525 — the TLS handshake with the origin failed; check ciphers and certificate.
- Error 526 — Full (strict) with an invalid, expired or self-signed origin certificate.
- Mixed content warnings — the origin emits http:// URLs in the page while visitors are on HTTPS.
- Padlock present but traffic unencrypted behind Cloudflare — Flexible, working exactly as configured.
How DomainLens contributes
From outside, an audit sees the visitor leg — which looks healthy in every mode, including Flexible. The SSL checker reports the certificate and protocol a hostname presents, and an unexpected issuer is a useful signal that a proxy sits in front. The origin leg has to be verified in the Cloudflare dashboard, because by design it is invisible from the public internet.
- Which Cloudflare SSL mode should I use?
- Full (strict), with a Cloudflare origin certificate installed on your server. It is free, it encrypts and validates the origin leg, and it avoids the redirect loops Flexible causes.
- Why do I get a redirect loop on Cloudflare?
- Almost always Flexible mode with an origin that redirects HTTP to HTTPS. Cloudflare arrives over HTTP, is redirected, and the cycle repeats. Switch to Full (strict).
- Is a Cloudflare origin certificate trusted by browsers?
- No, and it does not need to be. It secures the Cloudflare-to-origin leg only; visitors receive Cloudflare's own publicly trusted certificate.
- Does the SSL mode affect SEO?
- Not directly, since visitors and Googlebot both see HTTPS regardless. It matters through the failures it causes — redirect loops and 525 errors both break crawling outright.