Cloudflare SSL/TLS modes explained
Cloudflare's SSL/TLS mode decides how Cloudflare connects to your web server. Full (strict) is the recommended mode because it checks the server's certificate. Flexible should be avoided because the second half of the trip isn't encrypted.
Applies to: Cloudflare
On this page
Every visit to a proxied website on Cloudflare has two legs: from the visitor to Cloudflare, and from Cloudflare to your web server. The SSL/TLS encryption mode decides how the second leg works. Full (strict) is the recommended mode: the connection is encrypted and Cloudflare checks that your server's certificate is valid. Flexible is best avoided, because the leg to your server isn't encrypted at all. For domains on Oogle hosting, we set and maintain this for you.
The two legs
- Visitor to Cloudflare. Cloudflare presents its own edge certificate (Universal SSL). This is the padlock your visitors see. It's issued automatically, usually between 15 minutes and 24 hours after the domain becomes active, and only applies to proxied records. See Proxied or DNS only.
- Cloudflare to your server. Controlled by the SSL/TLS mode below. Your server needs its own valid certificate for the stricter modes.
The modes
| Mode | Cloudflare to your server | Certificate check | Use it? |
|---|---|---|---|
| Off | Plain HTTP; visitors get no HTTPS | None | No |
| Flexible | Plain HTTP | None | Avoid |
| Full | Encrypted | Not checked | Only as a stopgap |
| Full (strict) | Encrypted | Checked: valid, unexpired, right name | Yes, recommended |
| Strict (SSL-only origin pull) | Always HTTPS, even for HTTP visits | Checked | Special cases |
Cloudflare's default is Automatic, where its SSL/TLS Recommender picks a mode based on what your server supports.
Why Flexible causes trouble
With Flexible, visitors see a padlock but the traffic between Cloudflare and your server is unencrypted. And if the server itself redirects HTTP to HTTPS, which most websites do, Cloudflare keeps arriving over HTTP and the server keeps redirecting it. The visitor sees ERR_TOO_MANY_REDIRECTS.
Why Full (strict) is better
Full (strict) encrypts both legs and confirms the server's certificate is genuine and current. If that certificate expires or doesn't match the domain, Cloudflare shows an error rather than connecting insecurely: 526 for an invalid certificate, 525 if the encrypted connection can't be set up at all.
Related setting: Always Use HTTPS
Always Use HTTPS sends every HTTP visit to the HTTPS version at Cloudflare's edge. In Cloudflare's dashboard it lives under SSL/TLS → Edge Certificates. If it's on while the server redirects visitors back to HTTP, the result is a redirect loop.
For Oogle clients
You don't need to sign in to Cloudflare or choose a mode. For domains in Oogle's Cloudflare account, we set the mode and the certificate on your hosting so they work together, and we check the certificate when we connect your domain. If you have your own Cloudflare account, the mode is in the dashboard under SSL/TLS, and the safe approach is to make sure your server has a valid certificate before choosing Full (strict).
Check what visitors see
- Open your website in a browser.
- Select the padlock (or the site information icon) beside the address.
- Open the certificate details. For a proxied site, the certificate is issued to your domain through Cloudflare.
From a command line, this shows the certificate's issuer and dates:
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -issuer -datesReplace example.com with your domain. Look for a notAfter date in the future.
You'll know it's right when
Your website loads over https:// with a padlock, http:// addresses redirect to https:// once, and there are no Cloudflare 525 or 526 pages.
Troubleshooting
- Too many redirects. Often Flexible with a server that forces HTTPS, or Always Use HTTPS combined with a server that redirects to HTTP. See Fix DNS and SSL errors.
- Error 526. The server's certificate is expired, for the wrong name, missing its chain or self-signed.
- Error 525. The encrypted connection to the server failed, for example no valid certificate or port 443 closed.
- A certificate warning right after connecting your domain. The edge certificate can take up to 24 hours. If it lasts longer, open a Website Support ticket.
Next steps
- Fix DNS and SSL errors
- Proxied or DNS only
Frequently asked questions
Why is Flexible a problem?
Visitors see a padlock, but Cloudflare talks to your server over plain HTTP. If the server also redirects to HTTPS, visitors get a "too many redirects" error.
Do I need to change the SSL mode myself?
No. For domains in Oogle's Cloudflare account, we choose and maintain the setting. If you see a certificate or redirect error, open a ticket.
How long does a new certificate take?
Cloudflare's Universal SSL edge certificate is usually issued between 15 minutes and 24 hours after the domain becomes active. It's only presented for proxied records.