03 · Establish end-to-end SSL/TLS
Separate visitor-to-Cloudflare and Cloudflare-to-origin connections, configure Origin CA and Full strict, and diagnose 525, 526, or redirect loops.
Edited and verified by Orange Book Editorial Team ·
Recommended steady state
Install a valid origin certificate, enable HTTPS at the origin, and use Full (strict). Flexible is not a durable compatibility mode: it leaves the Cloudflare-to-origin leg unencrypted.
Both connections must work
flowchart LR
V[Visitor] <-->|Edge certificate / HTTPS| E[Cloudflare edge]
E <-->|Origin certificate / HTTPS| O[Origin]The Cloudflare edge certificate faces the browser. The origin certificate faces Cloudflare. A browser lock proves the first leg only; it cannot prove strict validation on the origin leg.
Choose an encryption mode
| Mode | Cloudflare to origin | Appropriate state | Main risk |
|---|---|---|---|
| Off | HTTP | Not a public-site steady state | No certificate-based encryption for the visitor either |
| Flexible | HTTP | A very short migration bridge | Plaintext origin leg and common HTTPS redirect loops |
| Full | HTTPS without strict validation | Origin TLS works but its certificate is not ready | Does not prove Cloudflare reached the intended origin |
| Full (strict) | HTTPS with certificate validation | Recommended steady state | Requires port 443, validity, hostname, and chain to be correct |
Choose an origin certificate
| Choice | Best for | Boundary |
|---|---|---|
| Publicly trusted certificate | Browsers or another proxy may reach the origin directly | Browser-verifiable; renewal belongs to you or the hosting platform |
| Cloudflare Origin CA | The origin accepts only Cloudflare proxy traffic | Available on all plans, but not trusted by a browser connecting directly |
Origin CA is not an edge certificate
Keep an Origin CA private key only at the origin. With this certificate, changing a hostname to DNS only, pausing Cloudflare, or browsing directly to the origin can show an untrusted-certificate warning. That is the certificate's trust boundary, not a random outage.
Configure Full (strict)
Confirm the edge certificate
Under SSL/TLS → Edge Certificates, inspect certificate status for the hostname. Do not publish long-lived HSTS before the edge certificate is ready.
Install an origin certificate
Use a public CA or create an Origin CA certificate under SSL/TLS → Origin Server. Store certificate and private key separately, install them on the server or load balancer receiving origin requests, and ensure port 443 is reachable.
Inspect the chain from a trusted environment
openssl s_client -connect 203.0.113.10:443 \
-servername www.example.com -showcerts </dev/nullInspect hostname, validity, and intermediate chain. Validate Origin CA within an environment that understands its dedicated trust chain; a browser's direct-origin result alone is not sufficient.
Select Full (strict)
Choose Full (strict) under SSL/TLS → Overview. Test a dynamic URL that must reach the origin before a static asset, so a cache hit cannot conceal an origin TLS failure.
curl -sS -D - -o /dev/null "https://www.example.com/health?tls-check=1"Consolidate HTTPS redirects later
After both TLS legs are stable, continue to Always Use HTTPS, minimum TLS, TLS 1.3, and HSTS. Change one layer at a time so a loop remains diagnosable.
Locate errors by leg
| Symptom | Likely leg | First evidence |
|---|---|---|
| Browser reports an edge certificate error | Visitor → Cloudflare | Edge certificate hostname, status, and validity |
| Cloudflare 525 | Cloudflare → origin handshake | Origin port 443, SNI, protocol/ciphers, and handshake logs |
| Cloudflare 526 | Full (strict) cannot validate the origin certificate | Validity, SAN/CN, issuer, and complete chain |
| ERR_TOO_MANY_REDIRECTS | Conflicting HTTPS policy | Flexible mode, origin redirects, Redirect Rules, and the actual Location chain |
| Mixed Content | HTTP resources remain in HTML | Browser console and resource URLs |
Use the shorter TLS mode decision page, or continue to layered Cloudflare 5xx troubleshooting when a 5xx appears.
Primary sources
Did this page help you complete your goal?
Beta feedback is generated in this browser and is never uploaded automatically.
02 · Decide between Proxied and DNS only
Decide when A, AAAA, and CNAME records should use the orange cloud and when mail, validation, or non-HTTP services must remain DNS only.
04 · Build an HTTPS and TLS 1.3 security baseline
After Full strict is stable, configure HTTPS redirects, minimum TLS, TLS 1.3, and HSTS in an order that preserves compatibility and rollback options.