Cloudflare Full Strict HTTPS flow

Question

I would like to understand Cloudflare full(strict) SSL flow. Because if user type https://example.com it redirects to Cloudflare web servers. So how Cloudflare decrypt HTTPS data before sending to origin host without browser warning ? How Cloudflare match certificate data between Browser and Cloudflare servers. Because main certificates situated on origin web server and only Original web server can decrypt after get HTTPS data.

Answer 1

The operator of the domain either uses Cloudflare as registrar or user another registrar and points the domain to Cloudflare's authoritative DNS servers.

This gives Cloudflare control over the domain, and they are able to issue valid TLS certificates for the domain, as they host it.

Cloudflare also host the authoritative DNS servers that reply with Cloudflare IP addresses to recursive DNS resolvers looking up the domain (maybe you use Cloudflare also for DNS resolving, but that is another thing entirely).

Cloudflare will even host DNS for you if you don't use Cloudflare as a reverse proxy / man-in-the-middle, but then of course they can't provide all the additonal services and they explain that.

Cloudflare uses anycast, and connections to Cloudflare IP addresses go to one of the ~200 Points of Presence (server farms) around the world, ideally the one closest in network topology terms (latency) to the client.

When a site uses Cloudflare, clients (browsers) only connect to Cloudflare's servers, never directly to the origin server. Requests go from the browser to Cloudflare's server and from Cloudflare's server to the origin server. Responses go back from the origin server to Cloudflare's server and from Cloudflare's server to the browser. The services Cloudflare provides are in filtering the requests and transforming and caching (storing for later) the responses, to make Cloudflare's server handle as much of the work as possible, to leave as little work as possible for the origin server. Depending on the site or application, a small origin server behind Cloudflare can handle a lot of user traffic and stand up to a big DDoS effort from attackers.

So, when a client (e.g. a web browser) connects to a site hosted by Cloudflare, the client connects to Cloudflare's servers. Cloudflare's servers perform DDoS protection, WAF, page rules, caching, CSS and JS minification, image optimization, data compression, run arbitrary javascript or WASM code provided by the site operator, and if needed, Cloudflare's server connect to the origin server, using TLS if possible, using mutual TLS authentication if desired, and performs an HTTP request that is processed and cached. The processed response is forwarded to the waiting client and potentially used to respond to other requests by other clients that reach the same Point of Presence (server farm).

Cloudflare is willing to connect to the origin server over cleartext HTTP, exposing user information to the internet, and then serve the response over HTTPS to the client, who sees a green lock icon. Some people don't like that. But Cloudflare also help site operators to set up TLS certificates (either trusted ones like Let's Encrypt or issued by Cloudflare's internal not-trusted CA) for the origin server. Cloudflare has a mode for their customers to maintain physical possession of their TLS keys, for example if required by regulation. And as I wrote, Cloudflare can use a client TLS certificate when performing "origin pull", if you setup your origin server appropriately.

Cloudflare is a CDN, yes, but it's more of a man-in-the-middle-as-a-service.