Run Cloudflare modes without an insecure SSL configuration

Which Cloudflare setting prevents a partially encrypted connection?

Full (strict) encrypts the origin path and verifies its certificate. Flexible remains unsuitable because Cloudflare can still reach the origin via HTTP; redirects must also not create a loop.

End-to-end HTTPS

1. Verify the origin for each production host directly via HTTPS for certificate, response, and a complete chain of trust.

2. Configure proxy headers and a single HTTPS redirect consistently.

3. Enable Full (strict) and monitor hostnames, error cases, and certificate renewals.

Flexible Path

• Flexible Path – The second connection remains unencrypted and cannot be certificate-verified.

• Error 526 – An invalid origin certificate prevents access after strict activation.

• Redirect Loop – Origin and Edge conflict over the expected protocol and forward the same request to each other without a stable end state.

Use Case: “Flexible Path”

The browser reaches Cloudflare encrypted, but the origin initially lacks a valid certificate. Only after setting up and directly verifying the origin TLS is Full (strict) enabled; an existing redirect evaluates the trusted proxy header.

Valid origin certificate

• Valid origin certificate – Runtime, hostname, and issuing trust chain meet the requirements.

• End-to-end HTTPS – Browser, edge, and origin paths remain encrypted and each use a verifiable connection for the requested host.

• Unique redirection – HTTPS is enforced at a clear point, without an edge-origin loop.

Unique redirection

• Origin TLS error by hostname and certificate cause.

• Redirect loops or HTTP accesses on the edge-origin path.

How “Running Cloudflare in Secure TLS Mode” relates to other decisions

An in-depth question answered Plan DNS changes during migrations without unnecessary downtime.How to plan DNS changes when cached responses don't disappear immediately?

Further Perspectives Systematically narrowing down error patterns after server migration.

If you want to practically implement "Running Cloudflare in Secure TLS Mode," you can refer to Robust Website Systems This document focuses on "DNS, TLS, and Reverse Proxy" and "Valid Origin Certificate."

Conclusion: Running Cloudflare in Secure TLS Mode

Secure Cloudflare TLS doesn't end at the edge. Strict certificate verification also protects the connection to the origin and makes its identity verifiable.

Sources and Further Information

The following official documentation and standards provide the technical classification.

• Cloudflare Origin CAThis documentation explains the use, installation, and limitations of origin CA certificates for a secure connection between Cloudflare and the origin server.

• Get Started with SSL/TLS — CloudflareThis introduction explains Universal SSL, encryption modes, origin configuration, and the step-by-step process of verifying a secure TLS chain.

• Full (Strict) Encryption Mode — CloudflareCloudflare describes Full (Strict) as end-to-end encryption with additional verification of the origin certificate's validity, hostname, and chain of trust.