Introducing Automatic SSL/TLS: securing and simplifying origin connectivity

Automatic SSL/TLS: Removing Guesswork From Origin Encryption

Cloudflare is finally delivering on a promise made during Birthday Week 2022: automatically securing the connection between its network and customer origin servers. The rollout begins August 8, 2024 for customers who have the SSL/TLS Recommender enabled, with the feature opening to remaining Free and Pro customers on September 16, 2024, followed by Business and Enterprise plans.

The delay between announcement and rollout was deliberate. Configuring origin security properly without risking downtime required careful engineering, particularly because origin server capabilities sit outside Cloudflare's direct control. The new Automatic SSL/TLS setting leverages the existing SSL/TLS Recommender to select the strongest encryption mode an origin can safely support.

From Universal SSL to Automatic SSL/TLS

Universal SSL, introduced in 2014, marked a turning point for encrypted traffic. Cloudflare began issuing free certificates to any web property on its network, eliminating the cost and complexity that had made HTTPS adoption slow. The number of encrypted connections across the Internet doubled as a result. But Universal SSL only addressed the browser-to-Cloudflare leg of the journey. The connection from Cloudflare to the origin still demanded manual configuration of encryption modes, and many site owners either skipped it or chose settings that left origin traffic unencrypted.

The mechanics of TLS are straightforward from a high level. A client advertises supported encryption parameters, the server selects its preferences and presents a certificate for identity validation, and both sides agree on a symmetric session key. Cloudflare sits between the browser and the origin, so two independent TLS sessions are established: one between the client and Cloudflare, another between Cloudflare and the origin.

The second connection is the problem. When Cloudflare acts as the client to an origin server, it cannot dictate what security configuration exists on that server. Customers must acquire and provision certificates—often using Cloudflare's Origin CA, ACME, or Certbot—and then tell Cloudflare what to expect. This configuration spans multiple systems and is prone to error. Missteps can cause outages, which is why many sites historically defaulted to Flexible mode, where browser traffic is encrypted but origin traffic is not.

"For a site that did not have SSL before, we will default to our Flexible SSL mode, which means traffic from browsers to Cloudflare will be encrypted, but traffic from Cloudflare to a site's origin server will not. We strongly recommend site owners install a certificate on their web servers so we can encrypt traffic to the origin."

Over time, Cloudflare shipped several tools to ease this burden—an origin certificate authority, Authenticated Origin Pulls to ensure only HTTPS requests reach the origin, and Cloudflare Tunnels for proactively established secure connections. Each addressed part of the problem but still required manual configuration. The SSL/TLS Recommender, launched in 2021, changed the equation by probing origins and determining whether a safer encryption mode could be used without breaking site functionality. After three years in production with consistently reliable recommendations, it now serves as the engine for automatic origin security.

How the SSL/TLS Recommender Works

Cloudflare currently supports five SSL/TLS encryption modes, each representing a different security posture for origin connections:

1. Off — no encryption between browser and Cloudflare, or between Cloudflare and origin.
2. Flexible — browser traffic may be HTTPS, but origin traffic is plaintext HTTP.
3. Full — Cloudflare mirrors the browser's protocol; if the browser uses HTTPS, Cloudflare uses HTTPS without validating the origin certificate.
4. Full (Strict) — same as Full, but the origin certificate is validated against a public CA or Cloudflare's Origin CA.
5. Strict (SSL-only origin pull) — Cloudflare always connects to the origin over HTTPS with certificate validation, regardless of browser protocol.

The Recommender operates like a web crawler with a security mission. It fetches pages over both HTTP and HTTPS using GET requests so no server state is modified, then compares content using a similarity algorithm adapted from research presented at TMA Conference 2020 ("A Deeper Look at Web Content Availability and Consistency over HTTP/S"). Matching content indicates the origin serves identical responses over both protocols, meaning the encryption mode can likely be tightened safely.

Caution is built into the system. The Recommender will not produce a recommendation for sites that are non-functional, block all bots, or enforce SSL/TLS-specific Page Rules or Configuration Rules. It may skip scans entirely under those conditions, erring on the side of preserving existing functionality rather than forcing a change that could cause issues.

Site owners can identify the crawler by its user agent, Cloudflare-SSLDetector, which appears in Cloudflare's list of known good bots. The crawler ignores robots.txt unless the file contains rules explicitly targeting its user agent, ensuring it can make accurate assessments in all circumstances.

Recommendations are currently delivered by email. The rollout of Automatic SSL/TLS transforms those suggestions into action, letting the Recommender's analysis update the encryption mode automatically. The result is a two-step improvement in origin security: customers no longer need to understand the nuances of each SSL/TLS mode, and the strongest configuration that works for each origin gets applied without manual intervention.

Automatic SSL/TLS: Moving from Recommendation to Action

Cloudflare’s SSL/TLS Recommender has long helped customers identify more secure encryption modes for their origin connections. While the system successfully guided over 2 million domains toward better settings, only 30% of its recommendations were actually followed. Customers received the advice but often failed to complete the final click needed to apply the upgraded settings.

With that friction in mind, Cloudflare is introducing Automatic SSL/TLS, a new option that acts on the Recommender’s findings without further customer input. The feature uses the same underlying logic as the SSL/TLS Recommender to evaluate a zone’s current setup and determine the most secure encryption mode that remains safe to apply given the origin server’s capabilities.

Zones using Automatic SSL/TLS will have the Recommender's recommended mode applied automatically. The existing Custom SSL/TLS option remains available for anyone who prefers manual control. Custom SSL/TLS behaves exactly like the current SSL/TLS mode selector: choose a setting, and Cloudflare will use it.

Automatic SSL/TLS is designed for entire zones and is ideal for single-origin setups. For configurations with multiple origins that have differing security capabilities, the feature will still find the most secure mode that functions across all origins handling traffic. Customers who need more granular control can use Configuration Rules to set specific SSL/TLS modes at the path, subdomain, or IP level. When a Configuration Rule or Page Rule includes SSL/TLS settings, those settings override the zone-wide Automatic or Custom SSL/TLS configuration.

Rollout timeline and defaults

By default, Cloudflare plans to make Automatic SSL/TLS the standard configuration for all zones. The rollout begins on August 8, 2024, for websites that currently have the SSL/TLS Recommender enabled. Those zones will have Automatic SSL/TLS turned on by default, with a one-month grace period before any scans are scheduled. Enterprise (ENT) customers receive a six-week grace period. Origin scanning for non-Enterprise customers starts the week of September 9, 2024, and on September 23, 2024 for Enterprise zones with the SSL Recommender enabled.

Starting in the second week of September, all new zones signing up for Cloudflare will also see Automatic SSL/TLS enabled by default.

From September 16, 2024, the remaining Free and Pro customers will receive the new Automatic SSL/TLS setting, also with a one-month opt-out window. Business and Enterprise customers will follow on a similar cadence after Free and Pro migration is complete. Migrations are communicated via email and through a banner in the dashboard. Zones already running in Strict or Full (Strict) mode, as well as zones that have opted out, are unaffected by the rollout.

Opting out

Manual control remains available. In the Overview tab of the SSL/TLS dashboard section, select Custom SSL/TLS instead of Automatic SSL/TLS. An opt-out leaves the currently configured SSL/TLS mode unchanged, and the encryption level can still be adjusted at any time using the Custom setting. Users can later opt back in by switching from Custom to Automatic.

For API-based opt-outs, the call shown below can be made any time prior to the grace period expiration. Refer to the request format in the dashboard or API documentation for your account’s region.

    curl --request PATCH \
        --url https://api.cloudflare.com/client/v4/zones/<insert_zone_tag_here>/settings/ssl_automatic_mode \
        --header 'Authorization: Bearer <insert_api_token_here>' \
        --header 'Content-Type: application/json' \
        --data '{"value":"custom"}'

Acting now or waiting for the migration

For customers who want automatic migrations right away, the fastest path is to enable the SSL/TLS Recommender before August 8, 2024. Websites that already use Full (strict) or Strict mode are operating at the highest level of origin-facing security; setup guides for both are available in the Cloudflare developer documentation. All other customers will be contacted when their migration is scheduled.