Description

Ensure the zone's SSL/TLS encryption mode is set to Full (strict), so that traffic between Cloudflare and your origin server is encrypted and Cloudflare checks that the origin presents a valid certificate from a trusted authority or a Cloudflare Origin CA certificate.

Rationale

With Flexible mode, traffic between Cloudflare and the origin is not encrypted. With Full mode, it is encrypted but the origin certificate is not checked, so an attacker could impersonate the origin. Full (strict) encrypts the connection and validates the certificate, preventing man-in-the-middle attacks.

Impact

  • Traffic to the origin is encrypted and the origin is verified

  • Prevents man-in-the-middle attacks between Cloudflare and the origin

  • The origin must have a valid certificate, or the site will show 526 errors

Default Value

Cloudflare may use Automatic SSL/TLS, which selects the mode for you, and many zones use Full or Flexible. Full (strict) must be selected if it is not already in use.

Pre-Requisites

  • Cloudflare account with Administrator or SSL/TLS permissions for the zone

  • A valid certificate on the origin server (a publicly trusted certificate or a Cloudflare Origin CA certificate)

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to SSL/TLS > Overview.

  4. Check the current encryption mode.

  5. If it is not Full (strict), follow the implementation steps.

Implementation Steps

  1. Install a valid certificate on the origin server, for example a Cloudflare Origin CA certificate.

  2. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  3. Select your account and the domain (zone) you want to review.

  4. Go to SSL/TLS > Overview.

  5. Select Configure (if Automatic SSL/TLS is selected, choose Custom SSL/TLS).

  6. Select Full (strict) and save.

  7. Confirm that the site loads without 526 errors.

Backout Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to SSL/TLS > Overview.

  4. Select Configure, choose the previous encryption mode, and save.

Reference