How secure is that technology? Can someone tamper with your traffic between a server and Cloudflare in the first place?

And if the answer is yes, how can you check if a website is using the Flexible SSL?

Obviously, it is not the most secure way to serve the server's data, but websites which don't want to pay for a certificate, they use that free feature.

Flexible SSL: There is an encrypted connection between your website visitors and CloudFlare, but not from CloudFlare to your server.

  • You do not need an SSL certificate on your server
  • Visitors will see the SSL lock icon in their browser

So 2 questions, the 2nd question is a summary of the first.

How secure is the Flexible SSL technology?

For example, can someone attack you with a Man-in-the-middle attack?

your server -> attacker -> cloudflare

If the answer to the first question is "It is not secure and there are a couple attacks that can be done like MITM attack", the second question is:

How can the attacker find out that there is a Flexible SSL connection?


1 Answer 1


Flexible SSL does not provide end-to-end encryption. From here:

Flexible SSL diagram

you can see that the CloudFlare link to the server is unencrypted.

However, as the user link to CloudFlare is, this mitigates most typical Man-In-The-Middle scenarios. For example, ranging from Mallory on the coffee shop wifi connection, to rogue employees at an ISP, all the way up to government agents in a regime (except for the case where this government controls their own trusted root/intermediary certificates they could use to sign your domain).

Risks of having the CloudFlare to server link unsecured means that not only is the traffic unencrypted, there is no authentication between CloudFlare and your server. Any attackers in such a privileged position to perform a BGP Hijacking attack, would be able to reassign the IP address of your server to their own server, and intercept the traffic. If you are connecting from CloudFlare to your server by means of a hostname, then some type of DNS attack may be possible. This would probably have to be an attack on the DNS records themselves rather than a DNS poisoning attack because it would be difficult to pinpoint which CloudFlare endpoint would be resolving the lookup.

This also does not protect you against any rogue ISP employees or government agents within your hosting country.

As for the end-user - there is no real way of telling whether a connection is via Flexible SSL because the browser address bar and padlock will only authenticate their connection to CloudFlare, not to your server.

As for any attacker - they may be able to do some passive recon and find out where your domain used to point to, giving them the address of your endpoint. From here they could try some direct connections to find out if your server accepts HTTPS connections, or is simply plain HTTP. You can mitigate this by blocking all source traffic not sent from CloudFlare's IP ranges.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .