Do I need an Origin Certificate if I'm hosting on cloudflare?

This is a probably a dumb question. I’ve read that in order to have full end to end encryption I need to enable Full Strict mode, which I have, and install an origin certificate on my origin server. However, I am also hosting my website here on Cloudflare, so do I need to do all that? I created an origin certificate but I don’t know what to do with it. I’d appreciate any clarification!

That is correct, only Full Strict provides proper and secure encryption, while the legacy modes Flexible and Full are insecure and provide no proper security.

As for hosting on Cloudflare, if you refer to Pages or something else, which is directly served by Cloudflare, then you won’t need an Origin certificate as the content is directly served by Cloudflare using the proxy certificate. If you are not referring to that and host content somewhere else, then you do need a valid certificate on your server as well.

Essentially, make sure you are using Full Strict and if everything is loading fine, then you have the right configuration.

Awesome, this was helpful! Yes, I was referring to Cloudflare Pages. Thanks!

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.