导航|地址|刷新
Full (strict)

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/ssl/llms.txt
Use this file to discover all available pages before exploring further.



DocsDirectoryAPISDKsChangelog

Search

Log in






SSL/TLS

/




Overview

Concepts

Get started


Edge certificates


Overview


Universal SSL


Overview

Enable Universal SSL certificates

Disable Universal SSL certificates

Alerts

Limitations

Troubleshooting






Advanced certificates


Overview

Manage advanced certificates

API commands






Custom certificates


Overview

Manage custom certificates

Renewal and expiration

Bundle methodologies

Remove key file password

Troubleshooting





Enforce HTTPS connections


Domain control validation (DCV)


Overview


Methods


Overview

Delegated

TXT

HTTP





Validation backoff schedule

Domain control validation flow

Troubleshooting






Geo Key ManagerBeta


Overview

Setup

Supported options





Add CAA records

Staging environmentBeta

Backup certificates

ECH ProtocolBeta


Additional options



Cipher suites


About


Customize cipher suites


Overview

Use the dashboard

Use the API





Security levels

Compliance standards

Supported cipher suites

Troubleshooting





Certificate Transparency MonitoringBeta

HTTP Strict Transport Security (HSTS)

Certificate Signing Requests (CSRs)

TLS 1.3

Minimum TLS Version

Automatic HTTPS Rewrites


Total TLS


Overview

Enable

Error messages





Always Use HTTPS

Opportunistic Encryption










Origin server



Encryption modes


Overview

Off (no encryption)

Flexible

Full

Full (strict)

Strict (SSL-Only Origin Pull)





Automatic key exchange to origins

SSL/TLS RecommenderDeprecated


Cloudflare origin CA


Setup

Troubleshooting






Authenticated Origin Pulls (mTLS)


Overview

About

AWS integration


Setup


Global

Zone-level

Per-hostname

Manage certificates

Rollback









Custom Origin Trust Store

Cipher suites






Client certificates (mTLS)


Overview

Create a client certificate

Enable mTLS

Bring your own CA (BYOCA)

Forward certificate to server

Label client certificates

Revoke a client certificate

Configure your mobile app or IoT device

Client certificate variables

Troubleshooting

mTLS for Zero Trust ↗





Cloudflare for SaaS ↗


Keyless SSL


Overview


Get started


Cloudflare Tunnel

Public DNS

Run with Docker






Hardware security modules


Overview

Configuration

AWS cloud HSM

Azure Dedicated HSM

Azure Managed HSM

Entrust nShield Connect

Fortanix DSM

Google Cloud HSM

IBM Cloud HSM

SoftHSMv2





Upgrade your key server


Reference


High availability

Scaling and benchmarking

Key server metrics

Keyless delegation





Glossary

Troubleshooting






Post-quantum


About PQC

PQC support

PQC in Cloudflare products

PQC to your origin

PQC and Cloudflare One






Reference


TLS protocols

Certificate and hostname priority

Certificate authorities

Browser compatibility


Migration guides


Entrust distrust

DigiCert G1 distrust





Rotate ACM certificate packs

Certificate pinning

Certificate statuses

Validity periods and renewal

Features and plans

Cloudflare and CVE-2019-1559

PCI compliance and vulnerabilities mitigation






Troubleshooting


Full resources list

General SSL errors

ERR_SSL_VERSION_OR_CIPHER_MISMATCH

ERR_SSL_PROTOCOL_ERROR

ERR_TOO_MANY_REDIRECTS

Mixed content errors





FAQ

Changelog


Agent resources


Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

SSL/TLS llms.txt ↗

SSL/TLS llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗













Home

/SSL/TLS

/…
Origin server


/Encryption modes

/Full (strict)



Full (strict)


Last updated Jul 9, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewUse whenRequired setup Prerequisites ProcessLimitations




When you set your encryption mode to Full (strict), Cloudflare does everything in Full mode but also enforces more stringent requirements for origin certificates.
flowchart LR accTitle: Full - Strict SSL/TLS Encryption accDescr: With an encryption mode of Full (strict), your application encrypts traffic going to and coming from Cloudflare. A[Visitor] <--Encrypted--> B((Cloudflare))<--Encrypted--> C[("Origin server (verified) #9989;")]

Use when


For the best security, choose Full (strict) mode whenever possible (unless you are an Enterprise customer).

Your origin needs to be able to support an SSL certificate that is:

Unexpired, meaning the certificate presents notBeforeDate < now() < notAfterDate.

Issued by a publicly trusted certificate authority ↗ or Cloudflare’s Origin CA.

Contains a Common Name (CN) or Subject Alternative Name (SAN) that matches the requested or target hostname.


Note


In addition to Full (strict) encryption, you can also set up Authenticated Origin Pulls to ensure all requests to your origin are evaluated before receiving a response.




Required setup



Prerequisites


Before enabling Full (strict) mode, make sure your origin:

Allows HTTPS connections on port 443.

Presents a certificate matching the requirements above.

Otherwise, your visitors may experience a 526 error.


Process







To change your encryption mode in the dashboard:


In the Cloudflare dashboard, go to the SSL/TLS Overview page.
Go to Overview ↗


Choose an encryption mode.




To adjust your encryption mode with the API, send a PATCH request with ssl as the setting name in the URI path, and the value parameter set to your desired setting (off, flexible, full, strict, or origin_pull).





Limitations


Depending on your origin configuration, you may have to adjust settings to avoid Mixed Content errors or redirect loops.


PreviousFullNextStrict (SSL-Only Origin Pull)


Was this helpful?

YesNo

Edit pageReport issue




On this page

Overview

Use when

Required setup

Prerequisites

Process

Limitations


Edit pageReport issue














Getting started
PlansContact salesPartnersFind a partnerStartupsUnder attack?Domain name search


Company
AboutCareersInvestorsPressPress kitGlobal network




Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG


Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse




Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog


Developers
DocumentationLearning centerCommunity




Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform


Start BuildingLog In












© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices








Docs




------
导航页 打开网址