Workflow: upgrading a zone from Flexible to Full (strict) SSL

TL;DR: Install the origin certificate Get a valid certificate on the origin covering the hostnames Cloudflare connects to. # Workflow: Flexible to Full (strict) ## 1. Cloudflare Origin CA certificates are free and trusted by Cloudflare.

Fix

1. Install the origin certificate Get a valid certificate on the origin covering the hostnames Cloudflare connects to. Expected: this specific failure stops.

2. Verify the origin serves HTTPS correctly when hit directly (bypass Cloudflare, ignore the name mismatch if testing by IP). ## 2. Expected: the value or setting is exactly right, nothing ambiguous.

3. Switch to Full Change the zone to Full: Cloudflare now talks HTTPS to the origin without validating the cert. Expected: the request routes instead of erroring.

4. Verify the site loads and. Expected: the value or setting is exactly right, nothing ambiguous.

5. Switch to Full (strict) Once Full is stable, move to Full (strict): Cloudflare validates the origin certificate. Expected: the request routes instead of erroring.

6. Purge the affected URLs after the mode change, or users keep hitting the old cached redirects. ## 5. Expected: this specific failure stops.

7. Lock it in Enable Always Use HTTPS and HSTS (carefully: HSTS is a commitment; test with a short max-age first). Expected: this specific failure stops.

8. Monitor origin cert expiry: Automatic SSL/TLS never downgrades you, so an expired cert on Full (strict) is an outage. ## Checklist - Cert on origin, then Full, verify, then Full (strict), verify, then purge. - Never go backward to Flexible to "fix" a 526: fix the cert instead. Expected: this specific failure stops.

Details

Workflow: Flexible to Full (strict) ## 1. Cloudflare Origin CA certificates are free and trusted by Cloudflare. curl -sI shows no redirect loop. This step alone eliminates the Flexible redirect-loop class. ## 3. Clear cached redirects The Flexible era may have cached redirect responses at the edge.

When to use

You hit exactly this: Workflow: upgrading a zone from Flexible to Full (strict) SSL in Workflow.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Workflow.

Edge cases

• A misconfigured cert now fails loudly instead of silently downgrading, which is what you want. ## 4.

Composite workflow grounded in verified docs: SSL modes (Flexible redirect-loop mechanism, Full/Full strict recommended), Origin CA certificates, Automatic SSL/TLS never downgrades, purge after mode transitions. Ref: https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/