Cloudflare's SSL mode controls how traffic is encrypted between visitors, Cloudflare's edge, and your origin server. Picking the wrong mode causes redirect loops, blank pages, or browser security warnings that drive visitors away.
This article explains exactly what each mode does, what errors it triggers when misconfigured, and which option you should pick for your setup.
The Four Cloudflare SSL Modes Explained
You'll find the setting under SSL/TLS > Overview in your Cloudflare dashboard:
| Mode | Visitor → Cloudflare | Cloudflare → Origin | Cert required on origin? |
|---|---|---|---|
| Off | HTTP | HTTP | No |
| Flexible | HTTPS | HTTP | No |
| Full | HTTPS | HTTPS | Yes (self-signed accepted) |
| Full (Strict) | HTTPS | HTTPS | Yes (valid CA-issued cert required) |
Flexible Mode
Traffic between the visitor and Cloudflare is encrypted, but the connection from Cloudflare to your server travels in plain HTTP. Your server needs no certificate at all.
It's the easiest mode to enable, but it's also the most dangerous if you handle any sensitive data — the last leg to your server is completely unencrypted.
Full Mode
Cloudflare also encrypts the connection to your server, but it does not verify the certificate it finds there. Self-signed, expired, or wrong-domain certificates are all accepted without complaint.
This is a real step up from Flexible, but an attacker on the path between Cloudflare and your host could present a rogue certificate without being caught.
Full (Strict) Mode
Same as Full, but Cloudflare validates the origin certificate: it must be issued by a recognized CA, currently valid, and cover the correct domain. The free Cloudflare Origin CA certificate (available in your dashboard) qualifies perfectly.
This is the recommended mode for any production site.
Common Errors and How to Fix Them
Error 525: SSL Handshake Failed
This happens when the mode is set to Full or Full Strict but your server has no SSL certificate installed, or the certificate has expired.
Fix:
- Install a valid certificate on your server — Let's Encrypt, Cloudflare Origin CA, or your hosting provider's certificate.
- If you're on cPanel, enable AutoSSL for automatic renewals.
- As a stopgap you can drop to Flexible, but plan the real fix immediately.
Error 526: Invalid SSL Certificate
Appears in Full Strict mode when a certificate exists on your server but fails Cloudflare's validation — typically because it's self-signed, expired, or issued for a different domain.
Fix:
- Generate a Cloudflare Origin CA certificate from SSL/TLS > Origin Server in the dashboard, install it on your server, and stay in Full Strict.
- Alternatively, install Let's Encrypt via certbot (or cPanel AutoSSL) and let it auto-renew every 90 days.
- If you truly can't install a valid cert right now, switch to Full (which accepts self-signed), not Flexible.
Infinite Redirect Loop (ERR_TOO_MANY_REDIRECTS)
This is by far the most common Cloudflare SSL error. It occurs when you have Flexible mode enabled in Cloudflare and your server or CMS forces HTTPS.
Here's the cycle:
- Cloudflare sends the request to your server over HTTP.
- Your server responds with a 301 redirect to HTTPS.
- Cloudflare sends the request again over HTTP… and the loop never ends.
Immediate fix: switch Cloudflare to Full or Full Strict (if you have a valid cert). The loop disappears instantly because Cloudflare stops sending plain HTTP requests to your origin.
Alternative fix if you must stay on Flexible: temporarily disable the HTTPS redirect rule on your server (.htaccess or your CMS/plugin settings), but treat this as a stopgap only.
Mixed Content Warnings
The page loads over HTTPS but some resources (images, scripts, CSS) are still served from HTTP URLs. The SSL mode doesn't cause this, but it can unmask it.
Enable SSL/TLS > Edge Certificates > Automatic HTTPS Rewrites in Cloudflare to rewrite sub-resource URLs on the fly. Also audit your CMS templates or theme to fix the URLs at the source.
Choosing the Right Mode for Your Setup
Use this decision tree:
- No certificate on your server at all? → Use Flexible temporarily while you install a proper cert. Don't leave it there.
- Self-signed or Cloudflare Origin CA certificate? → Use Full or Full Strict. Cloudflare Origin CA is accepted by Full Strict and is the cleanest option.
- Let's Encrypt, Sectigo, or another public CA cert? → Use Full Strict. It's the most secure and costs nothing extra.
- Site handles logins, forms, or payments? → Full Strict, no exceptions.
For most shared hosting setups running cPanel, the winning combination is AutoSSL enabled + Full Strict in Cloudflare. If you manage several domains and want this handled proactively, the team at elenlace.com's hosting support specialists can audit and maintain your SSL configuration for you.
Migrating from Flexible to Full Strict with Zero Downtime
- Confirm your server has a valid certificate installed (cPanel → SSL/TLS → Manage SSL Sites).
- Check the expiry date and ensure the domain on the cert matches your Cloudflare zone exactly.
- In Cloudflare, go to SSL/TLS > Overview and switch from Flexible to Full. Wait 30 seconds and verify the site loads without errors.
- If everything looks good, upgrade to Full Strict. The change takes effect instantly.
- Enable Always Use HTTPS under Edge Certificates and remove the duplicate redirect rule from
.htaccessif you had one.
Reviewing your SSL mode should be part of routine site maintenance. Find more guides like this one in our hosting and web tools comparisons section.
Key Takeaways
- Flexible is an emergency stopgap, not a permanent choice — traffic between Cloudflare and your server is unencrypted.
- Full encrypts the origin connection but doesn't validate the certificate; useful for self-signed certs.
- Full Strict is the only recommended mode for production — it requires a valid CA-issued cert (Let's Encrypt or Cloudflare Origin CA).
- The infinite redirect loop (ERR_TOO_MANY_REDIRECTS) almost always means Flexible mode is active while your server has an HTTPS redirect rule.
- Error 526 in Full Strict means your origin certificate is self-signed or expired.
- Migrating from Flexible to Full Strict takes under 5 minutes if you already have a valid cert installed.
Need someone to audit and permanently fix your site's SSL configuration? The team at elenlace.com provides security and configuration reviews for shared hosting, VPS, and Cloudflare-proxied environments.
FAQ
Can I use Flexible mode if my hosting doesn't support SSL?
Yes, but only as a temporary measure. Flexible protects the visitor-to-Cloudflare leg, but your server still receives unencrypted HTTP traffic. Switch to a host that includes Let's Encrypt or AutoSSL, or generate a free Cloudflare Origin CA certificate and install it on your server.
Does the Cloudflare Origin CA certificate work outside of Cloudflare?
No. The Origin CA is trusted only by Cloudflare's servers, not by browsers. If a visitor bypasses Cloudflare and hits your server directly, their browser will show an untrusted certificate warning. It's perfect for the Cloudflare-to-Origin leg but not for direct access.
Why is the redirect loop still happening after I switched to Full?
Your browser may have cached the redirect chain. Clear your browser cache or test in an incognito window. If the loop persists, check for a Cloudflare Page Rule forcing HTTP, or a WordPress plugin (such as Really Simple SSL) that is interfering with the request flow.
How often do I need to renew the SSL certificate on my server?
Let's Encrypt certificates expire every 90 days. cPanel's AutoSSL renews them automatically 30 days before expiry. Cloudflare Origin CA certificates can be issued with a validity of up to 15 years. Regardless of the type, set up a monitoring alert so you're notified if a certificate falls below 30 days of remaining validity.
Further reading
Other providers and guides worth comparing:
