Hey I have Cloudflare protecting my website. I had a Let's Encrypt SSL certificate encrypting it before. If I send a request and it passes through Cloudflare.
When it gets to my web server will it be secured by the Let's Encrypt SSL certificate?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
What do the SSL options mean?
Your domain's SSL option determines how Cloudflare connects to your server either using encryption or not.
SSL is terminated at the Cloudflare edge servers. Everything between your client and Cloudflare is encrypted, but between Cloudflare and your origin server is not encrypted. You would not need a certificate directly installed on your server for full encryption.
SSL is terminated at the Cloudflare edge server. Then it is encrypted again, and sent back to your servers all encrypted. You would need an SSL certificate installed directly on your server for this option. You can also use a self-signed certificate for this option.
SSL Full Strict:
Same as SSL Full, but you must have a trusted certificate that is signed by a valid Certificate Authority (such as GlobalSign or DigiCert).
Custom SSL (Business/Enterprise ONLY)
Customers on these plans are able to upload their own SSL key and certificate, so CloudFlare's name will not show if a visitor checks the certificate.
So as long as your domain is using the "SSL Full" or "SSL Full Strict" option, the traffic should be encrypted from Cloudflare to your server.
To set this option, go to the Cloudflare Dashboard for your domain, select the "Crypto" panel, and change the SSL Option from the default of "Flexible" to "Full (strict)". Since you're using Let's Encrypt on the origin server, strict mode should be acceptable for you.