Configuring SSL/TLS Settings: Securing Your Cloudflare Traffic

Previously in this course, we covered Cloudflare Proxy Fundamentals, where we learned how to toggle the "orange cloud" to route traffic through Cloudflare's edge network. Now that your traffic is flowing through our proxy, the next critical step is ensuring that the connection is encrypted from the user all the way to your origin server.

Understanding SSL/TLS Encryption Modes

When you proxy traffic through Cloudflare, the connection is split into two parts: the connection between the User and Cloudflare (the edge) and the connection between Cloudflare and your Origin Server.

Cloudflare provides four SSL/TLS modes to manage this relationship:

• Off: No encryption. Traffic is sent in plain text. Never use this for modern applications.
• Flexible: Encrypts the connection between the user and Cloudflare, but the connection from Cloudflare to your server is unencrypted (HTTP). This is rarely appropriate for production, as it leaves the last mile vulnerable.
• Full: Encrypts both legs. However, Cloudflare does not verify the certificate on your origin server. It will accept self-signed or expired certificates.
• Full (Strict): The gold standard. It requires a valid, trusted SSL certificate on your origin server. Cloudflare validates the certificate chain, ensuring the connection is secure and authentic.

Implementing Origin Certificates

If you are using Nginx SSL configuration on your own server, you might be used to managing certificates via Let's Encrypt. When using Cloudflare, you can simplify this by using a Cloudflare Origin Certificate.

An Origin Certificate is a free, Cloudflare-issued certificate that you install on your web server. Because Cloudflare trusts its own Certificate Authority (CA), you can set your SSL/TLS mode to Full (Strict), and Cloudflare will verify the certificate perfectly. This protects you from man-in-the-middle attacks between our edge and your server.

How to configure:

1. In your Cloudflare Dashboard, navigate to SSL/TLS > Origin Server.
2. Click Create Certificate.
3. Select "Let Cloudflare generate a private key and CSR."
4. Install the generated PEM files on your Nginx or Apache server.
5. Set your SSL/TLS mode to Full (Strict) in the Overview tab.

Forcing HTTPS

Even with encryption enabled, users might still try to access your site via http://. To prevent this, you should enforce HTTPS across your entire domain.

Navigate to SSL/TLS > Edge Certificates and toggle on Always Use HTTPS. This instructs Cloudflare to automatically redirect all HTTP requests to HTTPS, ensuring that no sensitive data is ever transmitted in plain text.

Hands-on Exercise: Audit Your Security

1. Check current mode: Log in to your Cloudflare dashboard and navigate to SSL/TLS. What is your current setting? If it is "Flexible," change it to "Full" or "Full (Strict)" immediately.
2. Toggle HTTPS: Ensure Always Use HTTPS is enabled under the Edge Certificates tab.
3. Verify: Open your browser in Incognito mode, visit your site using http://, and verify that it automatically redirects to https://.

Common Pitfalls

• The "Too Many Redirects" Loop: This usually happens if you have an SSL redirect enabled on your origin server (e.g., in Nginx) while also having "Always Use HTTPS" enabled in Cloudflare. Disable the redirect at the origin and let Cloudflare handle it at the edge.
• Ignoring Certificate Expiry: While Origin Certificates from Cloudflare can be set to last up to 15 years, if you use standard Let's Encrypt certificates, ensure your renewal process is automated to avoid site outages.
• Mixed Content: Enabling HTTPS might break some assets if they are hardcoded to http:// in your HTML. Use browser developer tools (Network tab) to identify and update those insecure references.

FAQ

Q: Do I need an SSL certificate on my origin if I use Cloudflare? A: Yes. Even if you use "Full," you need a certificate. For "Full (Strict)," that certificate must be valid and trusted.

Q: Can I use my own CA-signed certificate? A: Absolutely. Cloudflare supports certificates from standard CAs (like Let's Encrypt or DigiCert) for Full (Strict) mode.

Q: Does Cloudflare encrypt traffic by default? A: Yes, Cloudflare provides a Universal SSL certificate for the edge automatically, but you must configure the origin-side settings to ensure end-to-end security.

Recap

We have moved beyond simple DNS management and proxying to securing the data pipeline. By choosing Full (Strict) mode and utilizing Origin Certificates, you ensure that your infrastructure is protected against eavesdropping. Combined with Always Use HTTPS, your application is now significantly more resilient.

Up next: We will dive into Implementing Page Rules for Security to further refine how we handle redirects and security headers.