TL;DR: Install the origin certificate Get a valid certificate on the origin covering the hostnames Cloudflare connects to. # Workflow: Flexible to Full (strict) ## 1. Cloudflare Origin CA certificates are free and trusted by Cloudflare.

## Fix
1. Install the origin certificate Get a valid certificate on the origin covering the hostnames Cloudflare connects to.
   Expected: this specific failure stops.
2. Verify the origin serves HTTPS correctly when hit directly (bypass Cloudflare, ignore the name mismatch if testing by IP). ## 2.
   Expected: the value or setting is exactly right, nothing ambiguous.
3. Switch to Full Change the zone to Full: Cloudflare now talks HTTPS to the origin without validating the cert.
   Expected: the request routes instead of erroring.
4. Verify the site loads and.
   Expected: the value or setting is exactly right, nothing ambiguous.
5. Switch to Full (strict) Once Full is stable, move to Full (strict): Cloudflare validates the origin certificate.
   Expected: the request routes instead of erroring.
6. Purge the affected URLs after the mode change, or users keep hitting the old cached redirects. ## 5.
   Expected: this specific failure stops.
7. Lock it in Enable Always Use HTTPS and HSTS (carefully: HSTS is a commitment; test with a short max-age first).
   Expected: this specific failure stops.
8. Monitor origin cert expiry: Automatic SSL/TLS never downgrades you, so an expired cert on Full (strict) is an outage. ## Checklist - Cert on origin, then Full, verify, then Full (strict), verify, then purge. - Never go backward to Flexible to "fix" a 526: fix the cert instead.
   Expected: this specific failure stops.

## Details
# Workflow: Flexible to Full (strict) ## 1. Cloudflare Origin CA certificates are free and trusted by Cloudflare. `curl -sI` shows no redirect loop. This step alone eliminates the Flexible redirect-loop class. ## 3. Clear cached redirects The Flexible era may have cached redirect responses at the edge.

## When to use
You hit exactly this: Workflow: upgrading a zone from Flexible to Full (strict) SSL in Workflow.

## When not to use
A different error, or the same symptom in a different tool. This page only covers the failure above.

## Compatibility
Workflow.

## Edge cases
- A misconfigured cert now fails loudly instead of silently downgrading, which is what you want. ## 4.