TLS modes and two encrypted legs
Choose Flexible, Full, or Full strict by separating visitor-to-edge and edge-to-origin connections.
Edited and verified by Orange Book Editorial Team ·
Secure default
Prepare a valid origin certificate and prefer Full (strict). Flexible leaves the Cloudflare-to-origin leg unencrypted and is not a durable default.
Two connections
flowchart LR
U[Visitor] -->|HTTPS at the edge| E[Cloudflare edge]
E -->|Chosen encryption mode| O[Origin]| Mode | Edge to origin | Decision |
|---|---|---|
| Flexible | HTTP | A constrained migration bridge; the origin leg is plaintext |
| Full | HTTPS without strict certificate validation | Origin has TLS but cannot yet pass strict checks |
| Full (strict) | HTTPS with certificate validation | Recommended steady state; certificate must be valid and match the host |
Release checks
Validate origin TLS
From a trusted environment, inspect certificate expiry, hostname, and chain without bypassing access controls. Do not “fix” a 525 by blindly lowering encryption.
Enable strict mode
Test one static URL and one dynamic URL that reaches the origin. A cached page alone cannot prove the origin leg works.
Define rollback
If strict mode fails, retain the timestamp, Ray ID, and origin TLS logs. Any temporary downgrade needs an owner and expiry.
Redirect loops
Flexible plus an origin-side HTTP-to-HTTPS redirect commonly loops. Draw the two protocol legs before changing redirect rules.
Primary sources
Did this page help you complete your goal?
Beta feedback is generated in this browser and is never uploaded automatically.