SSL certificates have been available for free since Letsencrypt started in 2015.
But a lot of people don’t know about this, and hosting providers try to charge
hundreds of dollars per year for SSL certificates which should be free.
Don’t fall for it.
Cloudflare provide automatic SSL certs for all your domains which just work,
even on their Free plan.
This provides a SSL link between your users and Cloudflare.
If you host a static website without logins or private info, then this would be all you need.
If you have personal info on your servers, then use a free cert of a CF provided origin cert
to encrypt the connection between CF and your backend.
The option does exist for a reason, and is perfectly fine for public sites where users do not log in, and where there is no personal content. I help out with a number of sites which use this option
as they are hosted on providers which charge an unreasonable fee for SSL.
(Unreasonable in this context is any amount larger than zero).
As I already wrote, I’d recommend to check out aforementioned tutorials. This topic has been discussed a gazillion times and most certainly does not need another thread. Please use the search as well.
As mentioned, no, it is not perfectly fine and you should always choose Full Strict, otherwise your site will be insecure. Please do not mislead users.
Flexible SSL should be removed IMO, most that don’t know much fall into a false sense of safety when it is not. Not trying to pile on, but he speaks the truth.
The tutorial ends with the advice This is needed to make your site fully secure and is essential if you process any user submitted (e.g. logins) or personalized data through your site.
My emphasis.
So if your site does not process user submitted or personalised data, then flexible can be a reasonable
choice.
As I said, the option does exist for a reason.
Horses for courses.
Different people have different requirements when it comes to security.
And some have their hands tied by unreasonable policies imposed by hosting providers.
