When a site is proxied through Cloudflare (the orange cloud in DNS), there are two HTTPS connections and two certificates:
- Visitor → Cloudflare: secured by Cloudflare's edge certificate, which Cloudflare issues and renews for you.
- Cloudflare → your server (the origin): secured by your origin certificate, if you have one.
The SSL/TLS encryption mode (Cloudflare dashboard → your domain → SSL/TLS → Overview) decides how the second connection works.
The modes
| Mode | Cloudflare → origin | Origin certificate checked? | Use it? |
|---|---|---|---|
| Off | Plain HTTP; visitors get HTTP too | – | No |
| Flexible | Plain HTTP | – | Avoid: traffic to your server is unencrypted, though visitors see a padlock |
| Full | HTTPS | No: any certificate, even self-signed or expired | Only as a stepping stone |
| Full (strict) | HTTPS | Yes: must be valid, unexpired and match the hostname (a public CA or a Cloudflare Origin CA certificate) | Yes: recommended |
Cloudflare can also pick the mode for you (Automatic SSL/TLS), based on what your origin supports. Whichever you use, aim for Full (strict).
Getting to Full (strict)
Your origin needs a certificate Cloudflare will accept. Two options:
- Cloudflare Origin CA certificate (simplest). In SSL/TLS → Origin Server → Create Certificate, Cloudflare issues a free certificate valid for up to 15 years. Install it on your server like any other (Nginx, Apache, IIS). It's trusted only by Cloudflare, not by browsers, so the site must always stay proxied.
- A public certificate (for example Let's Encrypt). Trusted everywhere, so the site also works if you turn the proxy off; but it needs renewing like any other (Certbot guide).
Then switch the mode to Full (strict).
Common errors
| Error | Meaning | Fix |
|---|---|---|
| ERR_TOO_MANY_REDIRECTS | Flexible mode plus a server that redirects HTTP to HTTPS: Cloudflare connects over HTTP, the server redirects, forever | Install an origin certificate and use Full (strict), or remove the server's redirect and use Cloudflare's Always Use HTTPS |
| Error 525: SSL handshake failed | Cloudflare couldn't complete HTTPS with your server: nothing on port 443, or no protocol/cipher in common | Make sure the server listens on 443 with a certificate and TLS 1.2+ |
| Error 526: Invalid SSL certificate | Full (strict) and the origin certificate is expired, self-signed, or for another name | Renew or replace the origin certificate |
A 526 error appears when the origin certificate expires, even though visitors' padlock (the edge certificate) is fine. That's why the origin certificate needs watching too.
Monitoring both certificates
Any outside check of www.example.com, including our SSL checker, sees Cloudflare's edge certificate, which Cloudflare renews for you. To watch the origin certificate, check the origin directly:
- Give the origin its own DNS-only (grey cloud) hostname, such as
origin.example.com, with the origin certificate covering that name, and monitor that hostname; or - Check it from the server itself:
openssl s_client -connect localhost:443 -servername www.example.com </dev/null 2>/dev/null | openssl x509 -noout -enddate.
Cloudflare Origin CA certificates last years, so they're easy to forget. Public certificates on the origin renew every few months, so they're easy to break.
CertHalo can monitor both the public hostname and a DNS-only origin hostname, and emails you before either certificate expires. Monitor 3 certificates free.