SSL has been disabled for this zone (Code: 1006)

[orpobild]

Answer these questions to help the Community help you with Security questions.

What is the domain name?
Redacted due to public forum - oldest domain in my account

Have you searched for an answer?
Yes - same problem as Can't enable Universal SSL (Code: 1006), however there is no option to open a ticket as this domain is on a free plan.

Please share your search results url:
?

When you tested your domain, what were the results?
Cloudflare Universal SSL cannot be enabled - error “SSL has been disabled for this zone (Code: 1006)” is given.

Describe the issue you are having:
Cloudflare Universal SSL cannot be enabled - error “SSL has been disabled for this zone (Code: 1006)” is given.

What error message or number are you receiving?
SSL has been disabled for this zone (Code: 1006)

What steps have you taken to resolve the issue?

1. Disable/enable Cloudflare proxy (breaks website as SSL is required on origin server - redirect loop)
2. All options of encryption mode (strict/flexible is required as SSL is required on origin server)

Was the site working with SSL prior to adding it to Cloudflare?
Yes

What are the steps to reproduce the error:

1. Enable Universal SSL in Cloudflare dashboard

Have you tried from another browser and/or incognito mode?

Please attach a screenshot of the error:

[epic.network]

Welcome to the Cloudflare Community.

@orpobild

• Disable/enable Cloudflare proxy (breaks website as SSL is required on origin server - redirect loop)
• All options of encryption mode (strict/flexible is required as SSL is required on origin server)

These two items strongly suggest that your origin is not configured correctly and lacks the required HTTPS. Flexible does not use HTTPS and is completely insecure. Your origin site needs to work over HTTPS before you introduce Cloudflare.

You need to pause Cloudflare and fix your origin. You can use commercial certificates or free automated certificates like those issued by the Let’s Encrypt CA. If neither of those are to your liking, you can use a free certificate from the Cloudflare Origin CA. It will display an unknown issuer warning to direct connections. It is trusted by the Cloudflare proxy and will work with Full (Strict), which is the only mode that is sufficiently secure.

Pause Cloudflare · Cloudflare Fundamentals docs

Origin CA certificates · Cloudflare SSL/TLS docs

Why you should choose Full Strict, and only Full Strict

Unencrypted & unverified connections Imagine you open Paypal and suddenly get that warning [image] Would you continue? Probably not. For decades leaders in IT security have advocated that people upgrade their sites from unencrypted HTTP to secure HTTPS. And for a reason, everything you send via an HTTP connection is sent in plain text and can be intercepted at any point between you and the server. Equally, you’d probably not proceed if you got such a warning, right? [image] That’s when th…

[orpobild]

Apologies I meant to say Full, not Flexible. Though of course none of the options work anyway because Universal SSL cannot be enabled.

I already have SSL on my origin for many years that is working fine using Let’s Encrypt.

[orpobild]

I have it set to full, but I still get the error when enabling Universal SSL.

[orpobild]

Cloudflare is paused - if I enable it the website does not work due to SSL being required.

Cloudflare works with my other domains, which are hosted on the same server with identical NGINX ssl configurations.

[orpobild]

*I have it set to full strict, but I still get the error when enabling Universal SSL.

[epic.network]

I’ll escalate this post for the attention of the Customer Support Team so they can get back to you here. If you have already contacted Support, please share your ticket number here so that they can track it.

[Paige]

We have created ticket #2859453 in your Cloudflare account regarding this issue, and we will continue our investigation through the ticket. Please respond to the ticket when you have the chance. @orpobild