How to Set Up TLS on Cloudflare: A Step-by-Step Guide

August 28, 2025

Securing your website with TLS encryption is crucial for modern web security

Introduction

Transport Layer Security (TLS) is an essential protocol for securing data transmission between your website and its visitors. Cloudflare provides robust TLS encryption options that are both powerful and easy to configure. This guide will walk you through the process of setting up TLS on your Cloudflare-protected website, ensuring encrypted connections and enhanced security for your users. Proper TLS configuration not only protects sensitive data but also builds trust with your audience and can improve your search engine rankings.

SSL/TLS Encryption Modes in Cloudflare

Cloudflare offers several SSL/TLS encryption modes to secure connections between your visitors, Cloudflare’s network, and your origin server:

Off: No encryption between browser and Cloudflare (not recommended)
Flexible: Encrypts connection from browser to Cloudflare but not from Cloudflare to origin server
Full: Encrypts entire connection using a self-signed or valid certificate on your origin server
Full (Strict): Encrypts entire connection while requiring a valid certificate on your origin server

For maximum security, Full (Strict) mode is highly recommended as it ensures end-to-end encryption and validates your origin certificate.

Step-by-Step Setup Guide

1. Enable SSL/TLS Encryption

Log in to your Cloudflare dashboard and select your domain.
Navigate to the “SSL/TLS” section in the menu.
Under the “Overview” tab, select your desired encryption mode. For best security, choose “Full (Strict)”.

2. Obtain an Origin Certificate

For Full or Full (Strict) modes, you need a valid SSL certificate on your origin server:

In the Cloudflare dashboard, go to “SSL/TLS” > “Origin Server”
Click “Create Certificate”
Specify the domains to include (you can generate a wildcard certificate for subdomains)
Copy the generated certificate and private key

3. Install the Certificate on Your Origin Server

Install the certificate on your web server (e.g., Nginx, Apache):

For Nginx: Save the certificate as cert.pem and private key as key.pem, then update your server configuration:
1
2
ssl_certificate /etc/nginx/conf.d/certs/cert.pem;
ssl_certificate_key /etc/nginx/conf.d/certs/key.pem;

4. Enable HTTPS Redirect

Ensure all traffic uses HTTPS by creating a Page Rule:

In Cloudflare dashboard, go to “Rules” > “Page Rules”
Create a new page rule with the pattern http://*yourdomain.com/*
Select “Always Use HTTPS” as the setting

5. Verify Your Configuration

After implementation, verify your setup:

Visit your website in a browser and check for the padlock icon
Use online tools like SSL Labs’ SSL Test to analyze your configuration

Test with command line tools:

1	echo \| openssl s_client -connect yourdomain.com:443

Advanced Configuration: Per-Hostname TLS Settings

For more granular control, Cloudflare’s Advanced Certificate Manager allows you to configure TLS settings per hostname:

Set different minimum TLS versions for specific subdomains
Customize cipher suites for different parts of your domain
Balance security and compatibility based on specific needs

This is particularly useful for organizations that need to maintain compatibility with legacy systems while implementing strong security for newer services.

Checking Your TLS Version

It’s important to verify that your website is using updated TLS protocols. You can check your TLS version using:

OpenSSL: openssl s_client -connect example.com:443 -tls1_3
Browser Developer Tools: Check the Security tab in Network requests
Online tools: Various web-based SSL checkers provide detailed TLS information

Troubleshooting Common Issues

Too many redirects: Ensure you’re not enabling HTTPS redirect both in Cloudflare and your origin server
Certificate errors: Verify your origin certificate is properly installed and hasn’t expired
Mixed content warnings: Ensure all website resources (images, scripts) are loaded via HTTPS

Conclusion

Properly configuring TLS on your Cloudflare-protected website is essential for security, user trust, and SEO. By following these steps to implement Full (Strict) encryption mode, installing valid origin certificates, and enforcing HTTPS connections, you create a secure environment for your users’ data. Regularly review your TLS settings and stay updated with security best practices to maintain protection against evolving threats.

References

Cloudflare SSL Configuration Guide. CSDN Library
Multiple Methods to Check TLS Version on Linux. Tencent Cloud Developer Community
Nginx + CloudFlare SSL Deployment Application. YuQue
Introducing Per-Hostname TLS Settings. Cloudflare Blog
Detailed Explanation of Cloudflare Free SSL Certificate Settings. Baidu Developer

ScyScan Blog