SSL guides & resources
Cloudflare SSL: edge certificates, origin certificates and Full (strict)
Understand Cloudflare’s two TLS connections. Check origin certificate requirements, browser trust and safe troubleshooting before changing encryption mode.
Start by drawing the actual route: visitor, Cloudflare, then hosting server. A DNS-only hostname may connect directly to the server instead. Record which names are proxied and which services must remain reachable without Cloudflare before choosing an origin certificate.
For a Bangladesh business, this matters when a hosting company manages the server while another agency manages Cloudflare. Agree ownership of both certificates and both renewal processes; neither team should assume the other is monitoring everything.
In this guide
A practical checklist
Identify the edge and origin separately
Inspect the certificate seen by a normal browser, then ask the server administrator to inspect the origin through an authorized direct test. A public browser check of a proxied hostname normally tells you about the edge only.
Check Full (strict) prerequisites
The origin must accept HTTPS and present a suitable, unexpired certificate matching the requested hostname. Cloudflare supports publicly trusted certificates and its Origin CA for this connection. Confirm the actual hostname sent to the origin.
Choose a certificate for the intended access
A publicly trusted certificate can be appropriate when browsers or other clients also connect directly. Cloudflare Origin CA certificates are intended for Cloudflare-to-origin use and are not generally trusted by ordinary browsers.
Make the origin ready before changing mode
Install the correct certificate and chain, verify the HTTPS listener and check routing/firewall rules with the host. Keep a record of the previous settings and a recovery contact. Do not use a broad mode change as the first response to an unknown error.
Test application behaviour and monitor both expiries
After a controlled change, test redirects, forms, login and relevant API endpoints. Record the edge and origin renewal arrangements separately. Check DNS-only services rather than assuming the proxied website represents them.
Common problems and decisions
Cloudflare reports 526
Investigate origin certificate validation: expiry, name coverage, trust and chain. The exact cause needs checking; buying another certificate without that diagnosis may not help.
Cloudflare reports a handshake failure
A TLS handshake can fail for configuration or connectivity reasons as well as certificate problems. Ask for origin logs and a scoped test; do not assume every failure means a paid certificate is missing.
The site breaks after pausing Cloudflare
If the origin uses Origin CA only, direct browser access may fail trust checks. Plan direct-access requirements before changing proxy status or delegating emergency access.
Prepare for the next conversation
Supply support with the public hostname, proxy status, error code, origin certificate type and the time the issue began. Keep origin IP addresses and administrative access out of a public case study. A quotation should state whether work covers Cloudflare, the origin server or both, and who maintains renewals afterward.
Continue with the right guide or service
Common questions
Is Cloudflare’s visible certificate the one I installed in cPanel?
Not necessarily. A proxied site can show Cloudflare’s edge certificate while a different certificate is installed on the hosting server.
Do I always need to buy an origin certificate?
No. The suitable option depends on direct-access requirements, automation, validation and support. A compatible free public certificate or Cloudflare Origin CA may fit the architecture.
Can I fix an origin problem by disabling verification?
That can conceal the symptom while weakening the intended security. Diagnose and repair the origin configuration before treating the connection as verified.
Does Full (strict) remove the need for application security?
No. It validates the encrypted connection to the origin; it does not patch the application or protect a stolen administrator account.