Every time I activate Proxy in the DNS, the domain gets a reload loop

[nicolas21]

Hey, I am pretty new to Cloudflare and currently try to transfer the dns of a site to cloudflare.
The Problem is, every time I activate the proxy for a certain dns entry, this (sub)domain gets into a reload loop.
I don’t really know what to try or what information someone would need to debug this, so I would be very happy about any help atm
Nico

[cloonan]

@nicolas21

any help

Set SSL/TLS to Full (strict).

@nicolas21

what information

what is the name of the domain & subdomain?

[nicolas21]

Thanks this worked! Can you explain to me why this is? Flexible sounded like, well, a flexible solution that would work in more cases than strict

[cloonan]

@nicolas21

worked

Perfect,

@nicolas21

why

I am lifting the quoted text from the too many redirects community tip,

@system

If your SSL setting on the SSL/TLS app is Flexible and if your origin server is configured to redirect HTTP requests to HTTPS, server responses back to Cloudflare are encrypted. Since Cloudflare is expecting HTTP traffic, it keeps resending the same request, resulting in a redirect loop. This causes browsers to display “The page isn’t redirecting properly” or “ERR_TOO_MANY_REDIRECTS” errors.

[nicolas21]

I have just added a domain to cloudflare today, but am facing a problem:

Every time I activate cloudflare (“proxy” instead of “Just DNS”), the subdomain I have activated this for gets into a reload loop. As soon as I deactivate all cloudflare functionality (Just DNS), the subdomain works as expected again.
This is the case for multiple different IP addresses the dns is pointing to on multiple different servers from multiple different hosts. I therefore concluded that indeed cloudflare is the part that causes the problem.

As my Knowledge with cloudflare is very limited (I am a complete noob) I don’t really know where even to start debugging. Can anyone steer me into the right direction? For now I deactivated Cloudflare functionality for all DNS Entry’s that are production, but I would like to be able to use cloudflare.

Thanks a lot!
Nico

[DarkDeviL]

Can you please head over to https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls and check your current SSL/TLS encryption mode?

If it is currently set to Flexible, then switch to Full (Strict).

[nicolas21]

Ok, thanks this actually worked and seems like it solved the issue. Can you tell me why this is?

I thought strict would mean I would have to set up something on the receiving server to allow communication with cloudflare.

Thanks again!!!

[DarkDeviL]

@nicolas21

Can you tell me why this is?

I’ll quote my previous elaboration from this other thread back in January:

@DarkDeviL

When you are not running with Full (strict), the connection between Cloudflare and the server hosting your site is not properly secured.

The server hosting your website saw Cloudflare making the “insecure” request to your server, and your server sent the request to redirect to a secure communication, which Cloudflare then passed on to your browser.

Since the link it tried to redirect to was the exact same link as your browser was on, your browser would then try the same request again, and Cloudflare would again make the insecure request due to the SSL/TLS encryption mode, and the redirect would therefore happen over and over, as an endless loop, until your browser eventually gives up.