This connection is not private error

[collectivefriction]

I have a web site that hosts a game on a third party hosting platform. There is no SSL cert on my server (Its all free and no user data passes between browser and my server). I use Cloudflare just for the SSL cert. The website is [Preformatted text](http://www.squaredle.co.uk)

Mostly this seems to work OK but I have had the odd user tell me that when they try and access my server they get a warning “This connection is not private” and the “website maybe impersonating xxxxx” (where xxxxx seems to be a perfectly valid site).

I can’t see a way of installing a third party ssl cert on my server (the web host want me to buy one).

What are my options so that I can provide the minimal (and cheapest) level of security. (I make no money from this, its just a bit of fun, so I am trying to do it as cheaply as possible).

Thank You

[sandro]

@collectivefriction

There is no SSL cert on my server

That is the issue and what you need to fix. Your server needs to be secure first.

If your host requires you to buy a certificate you either need to do that or switch host, otherwise you can never have a secure site in the first place and hence receive such error messages. You also have a legacy encryption mode on Cloudflare, which is known for breaking sites.

In short, make sure your server is secure first and only then use Cloudflare. You can always take a look at Cloudflare’s Origin certificates.

[collectivefriction]

Thank You for your reply

So what is the point of the flexible SSL option in cloudflare and why do most of my users not get an issue?

[sandro]

There is no point in it, I am afraid.

Why flexible SSL mode is not the best choice

Flexible The connection between your visitor and Cloudflare is secured, but the connection between Cloudflare and your server is not. You will not need a certificate on your server for this mode. This option is NOT RECOMMENDED. Flexible makes your site only partially secure - it encrypts the connection between the visitor and Cloudflare - this means they see the in their browser and the site leaves the impression that it’s secure! However, the connection between Cloudflare and your orig…

It’s a legacy mode, which does not provide any security and breaks sites.

As mentioned, make sure your site is secure on HTTPS without Cloudflare and it will also work on Cloudflare. As long as you are not using Full Strict as encryption mode, you have an insecure site.

If you need a certificate, take a look at Let’s Encrypt or Cloudflare’s Origin certificates.

[collectivefriction]

Thanks again - assuming I add a cert to my server (Have to purchase - third party not supported). If I then choose strict mode will that be seemless - ie will there be any downtime for my users (thinking DNS propagation but assume this might not be relevant)

[sandro]

Generally not, you may want to take a look at How to eliminate (or minimise) downtime when adding your domain to Cloudflare as well.

I would recommend to pause Cloudflare, configure the server properly for SSL, make sure the site loads fine on HTTPS, and secure the encryption mode with Full Strict. Once that all works, you can unpause Cloudflare and it should work fine.

And yes, DNS propagation will not apply here.

[collectivefriction]

OK all seems OK for most testing I have done (Strict). but one user reports that they continually (2 days) get an error as below

[collectivefriction]

Other users and all the testing I do is fine!

[sandro]

So you are on Full Strict now? Then it should be all right.

As for the error you posted, your server will be sending an invalid response here. Take a look at Community Tip - Fixing Error 520: Web server is returning an unknown error

[collectivefriction]

Updated DNS to drop cloudflare and now seems OK.

[sandro]

Glad you got it sorted out.