# Workflow: Flexible to Full (strict)

## 1. Install the origin certificate

Get a valid certificate on the origin covering the hostnames Cloudflare connects to. Cloudflare Origin CA certificates are free and trusted by Cloudflare. Verify the origin serves HTTPS correctly when hit directly (bypass Cloudflare, ignore the name mismatch if testing by IP).

## 2. Switch to Full

Change the zone to Full: Cloudflare now talks HTTPS to the origin without validating the cert. Verify the site loads and `curl -sI` shows no redirect loop. This step alone eliminates the Flexible redirect-loop class.

## 3. Switch to Full (strict)

Once Full is stable, move to Full (strict): Cloudflare validates the origin certificate. A misconfigured cert now fails loudly instead of silently downgrading, which is what you want.

## 4. Clear cached redirects

The Flexible era may have cached redirect responses at the edge. Purge the affected URLs after the mode change, or users keep hitting the old cached redirects.

## 5. Lock it in

Enable Always Use HTTPS and HSTS (carefully: HSTS is a commitment; test with a short max-age first). Monitor origin cert expiry: Automatic SSL/TLS never downgrades you, so an expired cert on Full (strict) is an outage.

## Checklist

- Cert on origin, then Full, verify, then Full (strict), verify, then purge.
- Never go backward to Flexible to "fix" a 526: fix the cert instead.