Taking the Manual Work Out of Origin Encryption

When Cloudflare launched Universal SSL in 2014, it removed one of the biggest barriers to encrypted web traffic: getting a certificate and configuring it for a public-facing site was suddenly free and nearly effortless. The connection between a browser and Cloudflare could be secured instantly. The hop from Cloudflare to a customer's origin server, however, remained a different story.

Back then, setting up an origin server with its own SSL/TLS certificate was costly, complicated, and sometimes technically impossible. Customers had to procure certificates from third parties, upload them to their servers, and manually tell Cloudflare how to verify that server’s identity and what connection security it supported. Throw in load balancers or multiple subdomains with different backends, and the configuration task grew even more unwieldy.

Cloudflare responded over the years with free origin certificates, a service that recommends the highest safe SSL/TLS setting for a zone, and tools like authenticated origin pull and Cloudflare Tunnel. These helped, but they still required customers to actively make changes. Now Cloudflare is taking a different approach: it will automatically inspect each origin and use the most secure connection mode it can support, with no configuration required from the customer.

Why Automatic Origin Security Is Tricky

The difficulty with automating origin SSL/TLS is that Cloudflare cannot simply assume every origin supports the strongest encryption. Today, Cloudflare offers five distinct modes for the connection between its network and a customer’s origin:

  • Off — No encryption on either leg of the connection; plain-text HTTP everywhere.
  • Flexible — Browser-to-Cloudflare traffic can be HTTPS, but the Cloudflare-to-origin request is sent over unencrypted HTTP.
  • Full — Cloudflare mirrors the browser’s protocol when connecting to the origin. If the browser uses HTTPS, so does Cloudflare, but the origin’s certificate is not validated.
  • Full (strict) — Same as Full, but Cloudflare also validates the origin’s certificate, which can come from a public CA such as Let’s Encrypt or from Cloudflare’s own Origin CA.
  • Strict — Regardless of whether the browser request is HTTP or HTTPS, Cloudflare always connects to the origin over HTTPS and validates the origin certificate.

In practice, many customers signed up for Cloudflare when their origin could not handle advanced encryption, so their zones were set to Flexible or Off. Over time, the origin’s capabilities improved, but those old default settings remained in place. Cloudflare believes it is time to stop relying on those stale defaults.

Automatic Upgrades and Open Access to Strict Mode

Cloudflare will soon begin automatically moving sites to the highest SSL/TLS mode that is safe for their origins. The system will examine an origin, determine what it can support, and upgrade the connection without requiring the customer to do anything.

At the same time, Cloudflare is opening up all SSL/TLS modes to every plan level. Historically, Strict mode was reserved for Enterprise customers, a decision made in 2014 when few origins could speak TLS properly and the risk of breaking a site was high. That restriction is being removed with the rollout of automatic upgrades.

How the Scanning Works

To decide whether an origin can be upgraded, Cloudflare is reusing the SSL/TLS Recommender it introduced in 2021. The recommender checks whether backend communication can be moved to a higher security level by performing the following steps:

  • Crawling the site to collect links from various pages. For large sites, it samples a subset of links; for sites with few links, it appends a sample of links from recent visitor requests to the zone. The goal is a representative view of where requests go and how the origin responds.
  • Using the user agent Cloudflare-SSLDetector, which is on Cloudflare’s list of known “good bots.”
  • Downloading the content of each link over both HTTP and HTTPS, using only idempotent GET requests to avoid altering server state.
  • Running a content similarity algorithm to determine if the HTTP and HTTPS versions of each page match.
  • If the content matches, the origin is deemed capable of serving HTTPS, and the zone can be safely upgraded.
  • For sites already in Full mode, the recommender skips the crawl and simply performs a certificate validation to see if the zone can move to Full (strict) or higher.

If the scan shows the origin can handle the upgrade without breaking the site, Cloudflare will change the setting automatically. The company notes that it will not complete scans for origins that block the recommender, have a non-functional origin, or opt out of the service. Cloudflare says details for opting out will be sent via email.

Moving from Per-Zone to Per-Origin Settings

Another change aims at more precise security control. Currently, the SSL/TLS setting applies to an entire zone. That works fine for sites with a single origin, but for complex setups it forces everything down to the level of the least capable origin. For instance, a site where img.example.com and api.example.com run on separate origins with different security capabilities would have both capped at the weaker one.

With the new service, SSL/TLS security will be set per origin rather than per zone. That allows Cloudflare to give each backend server the strongest encryption it can support without limiting others. The change is designed to maximize the encryption posture of every origin on the network.

Why Some Customers Will Want to Stay on Lower Settings

Automatic upgrades are not for everyone. Cloudflare acknowledges that some customers deliberately choose a lower security level for reasons like performance concerns or because they are testing and debugging specific behaviors. To accommodate them, Cloudflare will provide the tools to manually configure the SSL/TLS mode even if it is not what the recommender would select.

The rollout is scheduled to begin before the end of 2022. Customers who want to ensure they are already at the highest level of origin security now can set their zones to Full (strict) or Strict mode manually. Those who prefer not to make changes can wait for Cloudflare to handle the upgrade, with email announcements coming to explain the schedule and how to opt out.