Workflow: upgrading a zone from Flexible to Full (strict) SSL
Guide Workflow: upgrading a zone from Flexible to Full (strict) SSL: Install the origin certificate Get a valid certificate on the origin covering the hostnames Cloudflare connects to. # Workflow: Flexible to Full (strict) ## 1. Use this when you hit exactly this in Workflow. Not for different errors or different tools.
TL;DR: Install the origin certificate Get a valid certificate on the origin covering the hostnames Cloudflare connects to. # Workflow: Flexible to Full (strict) ## 1. Cloudflare Origin CA certificates are free and trusted by Cloudflare.
Fix
Install the origin certificate Get a valid certificate on the origin covering the hostnames Cloudflare connects to. Expected: this specific failure stops.
Verify the origin serves HTTPS correctly when hit directly (bypass Cloudflare, ignore the name mismatch if testing by IP). ## 2. Expected: the value or setting is exactly right, nothing ambiguous.
Switch to Full Change the zone to Full: Cloudflare now talks HTTPS to the origin without validating the cert. Expected: the request routes instead of erroring.
Verify the site loads and. Expected: the value or setting is exactly right, nothing ambiguous.
Switch to Full (strict) Once Full is stable, move to Full (strict): Cloudflare validates the origin certificate. Expected: the request routes instead of erroring.
Purge the affected URLs after the mode change, or users keep hitting the old cached redirects. ## 5. Expected: this specific failure stops.
Lock it in Enable Always Use HTTPS and HSTS (carefully: HSTS is a commitment; test with a short max-age first). Expected: this specific failure stops.
Monitor origin cert expiry: Automatic SSL/TLS never downgrades you, so an expired cert on Full (strict) is an outage. ## Checklist - Cert on origin, then Full, verify, then Full (strict), verify, then purge. - Never go backward to Flexible to "fix" a 526: fix the cert instead. Expected: this specific failure stops.
Details
Workflow: Flexible to Full (strict) ## 1. Cloudflare Origin CA certificates are free and trusted by Cloudflare. curl -sI shows no redirect loop. This step alone eliminates the Flexible redirect-loop class. ## 3. Clear cached redirects The Flexible era may have cached redirect responses at the edge.
When to use
You hit exactly this: Workflow: upgrading a zone from Flexible to Full (strict) SSL in Workflow.
When not to use
A different error, or the same symptom in a different tool. This page only covers the failure above.
Compatibility
Workflow.
Edge cases
- A misconfigured cert now fails loudly instead of silently downgrading, which is what you want. ## 4.