Is it safe to only use CloudFlare's SSL cert

[dave2]

It seems the traffic from the origin server to Cloudflare would be exposed if the origin server didn’t have a cert.

[domjh]

@dave2

seems the traffic from the origin server to Cloudflare would be exposed if the origin server didn’t have a cert

Yes.

Why you should choose Full Strict, and only Full Strict

Unencrypted & unverified connections Imagine you open Paypal and suddenly get that warning [image] Would you continue? Probably not. For decades leaders in IT security have advocated that people upgrade their sites from unencrypted HTTP to secure HTTPS. And for a reason, everything you send via an HTTP connection is sent in plain text and can be intercepted at any point between you and the server. Equally, you’d probably not proceed if you got such a warning, right? [image] That’s when th…

[dave2]

Thanks for that link, it says

Make sure you have “Full Strict” selected here. Only when you have that mode selected you’ll have a guarantee that Cloudflare will verify the connection and will not allow third parties to take over your data. Anything else and it will be as if you had no certificate or one that can’t be verified (-> certificate warning) and will put your data and the data of your visitors at risk.

So I guess the answer is ‘No, you always need a cert, but CF will set you up with one. Just go to SSL/TLS->Origin Server and generate it.’ Maybe it’s a bit confusing the CF offers Flexible/Full if those modes are vulnerable.