My co-worker is telling me that the server we are using does not have an SSL certificate, so will we be able to use an SSL through Cloudflare and get that https://domain.com web address?
I put the website on Cloudflare yesterday, which I am told “comes with” an SSL certificate? So what do I need to do to force the SSL on all URLs for the website?
You can have a Flexible SSL cert through Cloudflare without a cert on your origin server. This is ‘partial’ HTTPS, the traffic is encrypted from the visitor to Cloudflare but then unencrypted between Cloudflare and your servers. You can set the SSL mode to ‘flexible’ in the SSL/TLS app and also select ‘Always use HTTPS’.
Alternatively, you could generate an origin cert through Cloudflare and install it on your server. You could then use Full ( or Full (strict)) SSL settings.
You can read more about SSL settings here:
https://support.cloudflare.com/hc/en-us/articles/200170416-What-do-the-SSL-options-mean-
And should be strongly discouraged 
If you want HTTPS configure a proper certificate on your server and set Cloudflare to “Full strict”.
@scott.allen, basically what @domjh mentioned as alternative.
Yes, it supports free SSL.
I guess I’m just trying to understand the concept of an SSL. I thought an SSL was a certificate saying that the server itself was safe. But in this instance, the server is maintained through NetSuite Sitebuilder, which I have been told is not possible to get an SSL through. So why would putting in an intermediary (Cloudflare) make the server safe? Does it make it MORE safe?
Right, that would be ideal, Sandro. But it seems as though that is not possible in our situation. We use NetSuite Sitebuilder and from what I am gathering, NetSuite not allowing an SSL on the Sitebuilder platform is NetSuite’s way of trying to “encourage” people up to a higher platform, such as NetSuite Advanced. Seems very archaic to me, but it is what it is.
SSL basically encrypts the web traffic between your site visitor and server (normally). This means that, for example, if the user entered any personal data, it shouldn’t be able to be read by 3rd parties intercepting the connection.
If Netsuite does not allow you to install an SSL cert on the server, then other than upgrading your NetSuite plan, your only option would be to use Flexible SSL mode. This encrypts the traffic between the visitor and Cloudflare (so they see the site as secure) but as @sandro said, it is not the best option.
If a service does not offer SSL in this day and age my only recommendation is to switch to a better alternative 
Agreed. The downside is that it’s extremely expensive to upgrade from NetSuite Sitebuilder to NetSuite Advanced, so they kinda have you in a jam. Works well for them though.
I would not upgrade, I would switch to another provider
True, but that brings in all kinds of other issues. We have 13 distribution centers across the US that all control their inventory through NetSuite.
Unfortunately, if the provider does not support SSL on your plan, you are left with very few other options. The Flexible SSL is not recommended and for better security you really need an SSL cert on your server.
Not sure what to suggest. Staying with that provider but not upgrading and making the site safe does not seem to be an option
This topic was automatically closed after 30 days. New replies are no longer allowed.