I'm using CloudFlare's flexible SSL:

Flexible SSL: You cannot configure HTTPS support on your origin, even with a certificate that is not valid for your site. Visitors will be able to access your site over HTTPS, but connections to your origin will be made over HTTP. Note: You may encounter a redirect loop with some origin configurations.

The reason I'm using it is simple: I can't afford paid SSL certificate and using Let's Encrypt doesn't seem great, due to the need for an update the certificate each 90 days.

I have several concerns about CloudFlare SSL and the HSTS use with anything that works as CloudFlare's flexible SSL(user-cloudflare with HTTPS, cloudflare-myServer with HTTP). How exactly in cases like this(http-CDN-https) security achieved with HSTS, or is it not?

Any additional explanations and recommendation would be highly appreciated.

closed as unclear what you're asking by Steffen Ullrich, multithr3at3d, Xander, Tom K., Stephane Jun 8 '18 at 15:12

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Your excuse for not using HTTPS to your origin at all is based on wrong understanding. You can use your own self-signed certificate, i.e. no need to buy something or use Let's Encrypt. To cite from their support site: Full SSL: A secure connection between your visitor and Cloudflare, plus a secure connection (but not authenticated) between Cloudflare and your web server. You will need to have your server configured to answer HTTPS connections, with at least a self-signed certificate." – Steffen Ullrich May 31 '18 at 5:58
  • Apart from that your question is not clear. What are exactly the concerns you have and how these are not addressed by the several questions about this topic on this site. And what has HSTS to do with it (which just means that HTTPS should be used for all future connections to this site)? – Steffen Ullrich May 31 '18 at 6:00
  • Thanks, @SteffenUllrich, I thought I need dedicated IP for the self-signed certificate(still worry about it, tho). So, if I make my own self-signed certificate, it will be secured connection(encrypted), but it will warn visitors if it's accessed directly(because it's self signed), but CloudFlare will accept it with Full SSL. Correct, right? If so, the end user still will get the warning message. isn't? – niguhuzal May 31 '18 at 6:22
  • The end user will not get a warning since it will have no contact with your (self-signed) certificate. All what he sees is the publicly trusted certificate created by CloudFlare for your site, not your original self-signed certificate. While FullSSL is not as secure as Strict FullSSL (where you need a publicly trusted certificate) it is more secure than FreeSSL. – Steffen Ullrich May 31 '18 at 6:38
  • 2
    Note that 90-day renewal is not inconvenient as it can be done automatically without user interaction. – multithr3at3d May 31 '18 at 16:41