Cloudflare Docs
SSL/TLS
Cloudflare Docs
SSL/TLS
Edit this page
Give us feedback
Set theme to dark (⇧+D)
  1. Products
  2. SSL/TLS
  3. ...
  4. Encryption modes
  5. Full

Full - SSL/TLS encryption modes

When you set your encryption mode to Full, Cloudflare allows HTTPS connections between your visitor and Cloudflare and makes connections to the origin using the scheme requested by the visitor. If your visitor uses http, then Cloudflare connects to the origin using plaintext HTTP and vice versa.

​​ Use when

Choose Full mode when your origin can support an SSL certification, but — for various reasons — it cannot support a valid, publicly trusted certificate.

​​ Required setup

​​ Prerequisites

Before enabling Full mode, make sure your origin allows HTTPS connections on port 443 and presents a certificate (self-signed, Cloudflare Origin CA, or purchased from a Certificate Authority). Otherwise, your visitors may experience a 525 error.

Depending on your origin configuration, you may have to adjust settings to avoid Mixed Content errors or redirect loops.

​​ Process

To change your encryption mode in the dashboard:

  1. Log in to the Cloudflare dashboard and select your account and domain.
  2. Go to SSL/TLS.
  3. Choose an encryption mode.
To adjust your encryption mode with the API, send a PATCH request with the value parameter set to your desired setting (off, flexible, full, strict).

​​ Limitations

The certificate presented by the origin will not be validated in any way. It can be expired, self-signed, or not even have a matching CN/SAN entry for the hostname requested.

Without using Full (strict), a malicious party could technically hijack the connection and present their own certificate.