What it is
Cloudflare provisions and manages free SSL/TLSTLSTransport Layer Security (formerly SSL) — the encryption behind HTTPS and the padlock in your browser. certificates for your domains and encrypts traffic between visitors, Cloudflare, and your originoriginYour own web server or host where your website actually lives. Cloudflare sits in front of it.. You control the encryption mode, enforce HTTPSHTTPSThe secure, encrypted version of HTTP (normal web traffic)., set a minimum TLS version, and enable HSTSHSTSHTTP Strict Transport Security — tells browsers to only ever connect to your site over secure HTTPS. — all without touching your servers.
Why it helps the client
- Free, auto-renewing certificates — no more expiry outages or manual renewals.
- End-to-end encryption with Full (strict) mode that validates the origin certificate.
- Enforce HTTPS, modern TLS, and HSTS for security, compliance, and SEO.
- Managed entirely at the edge — no certificate wrangling on origin servers.
Why they'd want it
- Eliminate certificate-expiry incidents and renewal toil for good.
- Meet 'encryption in transit' security and compliance requirements instantly.
- Better SEO and user trust from universal HTTPS.
🔬 How it actually works
- Cloudflare provisions free, auto-renewing certificates (Universal SSL) for your domains and terminates TLSTLSTransport Layer Security (formerly SSL) — the encryption behind HTTPS and the padlock in your browser. at the edgethe edge“The edge” means Cloudflare's servers spread across the world, close to your users — as opposed to one central data center.. Encryption modes control the originoriginYour own web server or host where your website actually lives. Cloudflare sits in front of it. leg: Off, Flexible (browser↔Cloudflare only), Full (Cloudflare↔origin encrypted with any cert), and Full (strict) (validates a trusted origin cert).
- Full (strict) is the target state — end-to-end encryption with originoriginYour own web server or host where your website actually lives. Cloudflare sits in front of it. certificate validation, defeating backend man-in-the-middle. Cloudflare offers free Origin CA certificates for the origin leg.
- Edgethe edge“The edge” means Cloudflare's servers spread across the world, close to your users — as opposed to one central data center. controls include Always Use HTTPSHTTPSThe secure, encrypted version of HTTP (normal web traffic). (http→https redirect), Automatic HTTPS Rewrites, minimum TLSTLSTransport Layer Security (formerly SSL) — the encryption behind HTTPS and the padlock in your browser. version, TLS 1.3, and HSTSHSTSHTTP Strict Transport Security — tells browsers to only ever connect to your site over secure HTTPS. — all applied centrally with no originoriginYour own web server or host where your website actually lives. Cloudflare sits in front of it. changes. Advanced/custom certificates and Keyless SSL exist for stricter needs.
- Because certificates auto-renew, the classic expired-certificate outage simply can't happen, and modern ciphers and protocols are enabled network-wide from one screen.
📖 Key terms on this page hover any underlined term anywhere on the site for its definition
- TLS
- Transport Layer Security (formerly SSL) — the encryption behind HTTPS and the padlock in your browser.
- HTTPS
- The secure, encrypted version of HTTP (normal web traffic).
- HSTS
- HTTP Strict Transport Security — tells browsers to only ever connect to your site over secure HTTPS.
- the edge
- “The edge” means Cloudflare's servers spread across the world, close to your users — as opposed to one central data center.
- origin
- Your own web server or host where your website actually lives. Cloudflare sits in front of it.
- WAF
- Web Application Firewall — inspects web requests and blocks malicious ones (like SQL injection and XSS) before they reach your site.
- bot
- Automated software making requests instead of a human. Some bots are good (search engines); many are malicious.
Live demo walkthrough
5 stepsScreens below are annotated recreations of the Cloudflare dashboard. The numbered orange pin marks exactly where to click.
Select the website
Websites
Select a website to manage its configuration.
👉 Do this
Open the site you want to secure with TLS.
💬 Say this
“Let's make sure traffic to this site is encrypted end-to-end — and that certificates never expire on us again.”
Open SSL/TLS → Overview
SSL/TLS
Overview
👉 Do this
Expand SSL/TLS and click Overview.
💬 Say this
“Cloudflare has already issued a free, auto-renewing certificate for this domain. This screen controls how encryption is applied.”
See the managed certificate
SSL/TLS
Edge Certificates
👉 Do this
Open Edge Certificates and point to the active Universal certificate and its expiry.
💬 Say this
“Here's the certificate Cloudflare issued and manages — covering the apex and every subdomain, auto-renewing well before it expires. No CSRs, no cron jobs, no calendar reminders. The '2 a.m. cert-expiry outage' just stops being a category of incident.”
Set Full (strict) encryption
SSL/TLS
Overview
👉 Do this
Select the 'Full (strict)' encryption mode.
💬 Say this
“We set encryption mode to Full (strict): traffic is encrypted end-to-end, and Cloudflare verifies the origin is presenting a valid, trusted certificate. No self-signed gaps, no downgrade.”
Enforce HTTPS everywhere
SSL/TLS
Overview
👉 Do this
Enable 'Always Use HTTPS'; confirm Min TLS 1.2 and HSTS.
💬 Say this
“Always Use HTTPS auto-redirects every http request to https. We set a minimum of TLS 1.2 and turn on HSTS. It's all managed here — and because the certs auto-renew forever, that dreaded 2 a.m. expiry outage simply can't happen.”