Cloudflare automatically issues a free certificate for any domain added to it, covering the connection between a visitor and Cloudflare's edge. This is separate from — and doesn't replace — a certificate on your actual origin server, and the relationship between the two is a common source of confusion.
| SSL/TLS mode | Visitor→Cloudflare | Cloudflare→Origin |
| Off | Plain HTTP | Plain HTTP |
| Flexible | Encrypted | Plain HTTP |
| Full | Encrypted | Encrypted (unvalidated) |
| Full (strict) | Encrypted | Encrypted & validated |
What Universal SSL in reality covers
Cloudflare's automatic certificate secures the browser-to-Cloudflare-edge connection only. Whether the second hop, Cloudflare to your actual origin server, is also encrypted depends entirely on your configured SSL/TLS mode, and this is where the confusion — and in some configurations, a genuine security gap — comes from.
The four SSL/TLS modes, and what each one does
"Off" sends everything in plain HTTP end to end — genuinely insecure, and not a reasonable choice for any production site. "Flexible" encrypts visitor-to-Cloudflare but sends Cloudflare-to-origin in plain HTTP — meaning your origin server never needs a certificate at all, but traffic between Cloudflare and your server travels unencrypted, which matters if that path crosses any network you don't fully control. "Full" encrypts both hops, but doesn't validate your origin's certificate — accepting even a self-signed one. "Full (strict)" encrypts both hops and validates your origin's certificate against a trusted CA, refusing to connect otherwise — the only one of the four that provides genuine end-to-end assurance rather than just end-to-end encryption.
Why "Flexible" mode is a more common mistake than it should be
Flexible mode is often selected because it's the easiest to set up — no certificate needed on the origin at all — without realizing that the second hop is left completely unencrypted. For a site on shared hosting where the origin genuinely can't have HTTPS configured, this may be an acceptable, informed trade-off; for a VPS or dedicated server where installing a certificate is entirely within your control, it's usually an oversight rather than a deliberate choice, and worth revisiting.
When you specifically need your own certificate on the origin
"Full (strict)" mode requires it — Cloudflare needs to validate a real, trusted certificate on the origin, and will refuse the connection without one. Beyond that specific mode, you'd also want your own certificate if you ever need the origin to be reachable directly (bypassing Cloudflare entirely) with a working, trusted HTTPS connection — during a Cloudflare outage, for instance, or for internal tooling that connects to the origin's IP rather than through Cloudflare's proxy.
Cloudflare's Origin CA certificates as a middle option
Cloudflare offers its own free "Origin CA" certificates in particular for the Cloudflare-to-origin hop — trusted by Cloudflare, but not by browsers immediately, since they're not intended for direct visitor connections. These work well for "Full (strict)" mode, giving you real origin-side encryption and validation without needing a separate certificate from a public CA, as long as the origin is never accessed outright by a browser bypassing Cloudflare.
A reasonable default for most sites
"Full (strict)," using either a Cloudflare Origin CA certificate or your own public certificate on the origin, is the generally recommended baseline — it provides genuine end-to-end encryption and validation with a setup cost that's modest given how much protection it adds over "Flexible" precisely.