导航|地址|刷新
Full

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/ssl/llms.txt
Use this file to discover all available pages before exploring further.

Docs Directory API SDKs Changelog

Search

Log in

SSL/TLS

/

Overview

Concepts

Get started

Edge certificates

Overview

Universal SSL

Overview

Enable Universal SSL certificates

Disable Universal SSL certificates

Alerts

Limitations

Troubleshooting

Advanced certificates

Overview

Manage advanced certificates

API commands

Custom certificates

Overview

Manage custom certificates

Renewal and expiration

Bundle methodologies

Remove key file password

Troubleshooting

Enforce HTTPS connections

Domain control validation (DCV)

Overview

Methods

Overview

Delegated

TXT

HTTP

Validation backoff schedule

Domain control validation flow

Troubleshooting

Geo Key ManagerBeta

Overview

Setup

Supported options

Add CAA records

Staging environmentBeta

Backup certificates

ECH ProtocolBeta

Additional options

Cipher suites

About

Customize cipher suites

Overview

Use the dashboard

Use the API

Security levels

Compliance standards

Supported cipher suites

Troubleshooting

Certificate Transparency MonitoringBeta

HTTP Strict Transport Security (HSTS)

Certificate Signing Requests (CSRs)

TLS 1.3

Minimum TLS Version

Automatic HTTPS Rewrites

Total TLS

Overview

Enable

Error messages

Always Use HTTPS

Opportunistic Encryption

Origin server

Encryption modes

Overview

Off (no encryption)

Flexible

Full

Full (strict)

Strict (SSL-Only Origin Pull)

Automatic key exchange to origins

SSL/TLS RecommenderDeprecated

Cloudflare origin CA

Setup

Troubleshooting

Authenticated Origin Pulls (mTLS)

Overview

About

AWS integration

Setup

Global

Zone-level

Per-hostname

Manage certificates

Rollback

Custom Origin Trust Store

Cipher suites

Client certificates (mTLS)

Overview

Create a client certificate

Enable mTLS

Bring your own CA (BYOCA)

Forward certificate to server

Label client certificates

Revoke a client certificate

Configure your mobile app or IoT device

Client certificate variables

Troubleshooting

mTLS for Zero Trust ↗

Cloudflare for SaaS ↗

Keyless SSL

Overview

Get started

Cloudflare Tunnel

Public DNS

Run with Docker

Hardware security modules

Overview

Configuration

AWS cloud HSM

Azure Dedicated HSM

Azure Managed HSM

Entrust nShield Connect

Fortanix DSM

Google Cloud HSM

IBM Cloud HSM

SoftHSMv2

Upgrade your key server

Reference

High availability

Scaling and benchmarking

Key server metrics

Keyless delegation

Glossary

Troubleshooting

Post-quantum

About PQC

PQC support

PQC in Cloudflare products

PQC to your origin

PQC and Cloudflare One

Reference

TLS protocols

Certificate and hostname priority

Certificate authorities

Browser compatibility

Migration guides

Entrust distrust

DigiCert G1 distrust

Rotate ACM certificate packs

Certificate pinning

Certificate statuses

Validity periods and renewal

Features and plans

Cloudflare and CVE-2019-1559

PCI compliance and vulnerabilities mitigation

Troubleshooting

Full resources list

General SSL errors

ERR_SSL_VERSION_OR_CIPHER_MISMATCH

ERR_SSL_PROTOCOL_ERROR

ERR_TOO_MANY_REDIRECTS

Mixed content errors

FAQ

Changelog

Agent resources

Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

SSL/TLS llms.txt ↗

SSL/TLS llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗

Home

/SSL/TLS

/…
Origin server

/Encryption modes

/Full

Full

Last updated Jul 9, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewUse whenRequired setup Prerequisites ProcessLimitations

When you set your encryption mode to Full, Cloudflare allows HTTPS connections between your visitor and Cloudflare and makes connections to the origin using the scheme requested by the visitor. If your visitor uses http, then Cloudflare connects to the origin using plaintext HTTP and vice versa.

Use when

Choose Full mode when your origin can support an SSL certification, but — for various reasons — it cannot support a valid, publicly trusted certificate.

Note

In addition to Full encryption, you can also set up Authenticated Origin Pulls to ensure all requests to your origin are evaluated before receiving a response.

Required setup

Prerequisites

Before enabling Full mode, make sure your origin allows HTTPS connections on port 443 and presents a certificate (self-signed, Cloudflare Origin CA, or purchased from a Certificate Authority). Otherwise, your visitors may experience a 525 error.

Depending on your origin configuration, you may have to adjust settings to avoid Mixed Content errors or redirect loops.

Process

To change your encryption mode in the dashboard:

In the Cloudflare dashboard, go to the SSL/TLS Overview page.
Go to Overview ↗

Choose an encryption mode.

To adjust your encryption mode with the API, send a PATCH request with ssl as the setting name in the URI path, and the value parameter set to your desired setting (off, flexible, full, strict, or origin_pull).

Limitations

The certificate presented by the origin will not be validated in any way. It can be expired, self-signed, or not even have a matching CN/SAN entry for the hostname requested.

Without using Full (strict), a malicious party could technically hijack the connection and present their own certificate.

PreviousFlexibleNextFull (strict)

Was this helpful?

YesNo

Edit pageReport issue

On this page

Overview

Use when

Required setup

Prerequisites

Process

Limitations

Edit pageReport issue

Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search

Company
AboutCareersInvestorsPressPress kitGlobal network

Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG

Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse

Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog

Developers
DocumentationLearning centerCommunity

Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform

Start BuildingLog In

© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices

Docs

------
导航页打开网址