FAQ: SSL, TLS, and HTTPS
Answers about edge and origin certificates, Full (strict), redirect loops, 525/526, Origin CA, and HSTS.
Edited and verified by Orange Book Editorial Team ·
Does the origin still need a certificate after Cloudflare issues an edge certificate?
Yes. Visitor-to-Cloudflare and Cloudflare-to-origin are separate TLS segments. The edge certificate protects only the first. Full (strict) also requires an unexpired origin certificate with a matching hostname, complete chain, and a trust path Cloudflare accepts. See end-to-end TLS.
Which SSL/TLS encryption mode should I use?
Establish a verifiable origin certificate and prefer Full (strict) for production. Flexible leaves the Cloudflare-to-origin segment unencrypted and commonly conflicts with origin HTTPS redirects. Do not treat a weaker mode as a permanent repair.
Why did enabling HTTPS cause ERR_TOO_MANY_REDIRECTS?
Trace every hop. Flexible plus an origin HTTPS redirect, Full/Full (strict) plus an origin redirect back to HTTP, or conflicting redirect rules can loop. Keep one authoritative redirect and inspect the chain with curl -I -L --max-redirs 10.
What is the difference between 525 and 526?
525 means the TLS handshake between Cloudflare and the origin failed; inspect certificates, port 443, SNI, cipher suites, and origin SSL logs. 526 means Full (strict) could not validate the origin certificate; inspect validity, hostname coverage, and the complete chain.
Why is an Origin CA certificate untrusted in a browser?
Origin CA is trusted by Cloudflare for the origin segment, not by public browsers for direct origin access. A gray-clouded or direct request can therefore fail. Install a publicly trusted certificate if direct client access is a required fallback.
Why does 525 still occur intermittently after installing a certificate?
Correlate timestamps across every origin instance, load balancer backend, and SSL log. Confirm every IP listens on the right port and presents the same chain. One successful browser visit does not prove every edge-to-origin path is healthy.
Should I enable HSTS with a long duration immediately?
No. HSTS makes browsers enforce HTTPS for its lifetime, so a later certificate or HTTPS failure cannot be bypassed with HTTP. Stabilize HTTPS, subdomain coverage, and rollback first; then increase a short max-age gradually. Follow the HTTPS and TLS 1.3 baseline.
Primary sources
Did this page help you complete your goal?
Beta feedback is generated in this browser and is never uploaded automatically.