I would like to understand Cloudflare full(strict) SSL flow. Because if user type https://example.com it redirects to Cloudflare web servers. So how Cloudflare decrypt HTTPS data before sending to origin host without browser warning ? How Cloudflare match certificate data between Browser and Cloudflare servers. Because main certificates situated on origin web server and only Original web server can decrypt after get HTTPS data.

1 Answer 1


The operator of the domain either uses Cloudflare as registrar or user another registrar and points the domain to Cloudflare's authoritative DNS servers.

This gives Cloudflare control over the domain, and they are able to issue valid TLS certificates for the domain, as they host it.

Cloudflare also host the authoritative DNS servers that reply with Cloudflare IP addresses to recursive DNS resolvers looking up the domain (maybe you use Cloudflare also for DNS resolving, but that is another thing entirely).

Cloudflare will even host DNS for you if you don't use Cloudflare as a reverse proxy / man-in-the-middle, but then of course they can't provide all the additonal services and they explain that.

Cloudflare uses anycast, and connections to Cloudflare IP addresses go to one of the ~200 Points of Presence (server farms) around the world, ideally the one closest in network topology terms (latency) to the client.

When a site uses Cloudflare, clients (browsers) only connect to Cloudflare's servers, never directly to the origin server. Requests go from the browser to Cloudflare's server and from Cloudflare's server to the origin server. Responses go back from the origin server to Cloudflare's server and from Cloudflare's server to the browser. The services Cloudflare provides are in filtering the requests and transforming and caching (storing for later) the responses, to make Cloudflare's server handle as much of the work as possible, to leave as little work as possible for the origin server. Depending on the site or application, a small origin server behind Cloudflare can handle a lot of user traffic and stand up to a big DDoS effort from attackers.

So, when a client (e.g. a web browser) connects to a site hosted by Cloudflare, the client connects to Cloudflare's servers. Cloudflare's servers perform DDoS protection, WAF, page rules, caching, CSS and JS minification, image optimization, data compression, run arbitrary javascript or WASM code provided by the site operator, and if needed, Cloudflare's server connect to the origin server, using TLS if possible, using mutual TLS authentication if desired, and performs an HTTP request that is processed and cached. The processed response is forwarded to the waiting client and potentially used to respond to other requests by other clients that reach the same Point of Presence (server farm).

Cloudflare is willing to connect to the origin server over cleartext HTTP, exposing user information to the internet, and then serve the response over HTTPS to the client, who sees a green lock icon. Some people don't like that. But Cloudflare also help site operators to set up TLS certificates (either trusted ones like Let's Encrypt or issued by Cloudflare's internal not-trusted CA) for the origin server. Cloudflare has a mode for their customers to maintain physical possession of their TLS keys, for example if required by regulation. And as I wrote, Cloudflare can use a client TLS certificate when performing "origin pull", if you setup your origin server appropriately.

Cloudflare is a CDN, yes, but it's more of a man-in-the-middle-as-a-service.

  • If I have domain SSL certificates (from Comodo) and trying to change domain to cloudflare, then how cloudflare also issue same certificate domain data ?
    – aze2201
    May 6, 2020 at 22:57
  • I open browser and type example.com and cloudflare how can decrypt ? Because oroginal certificates issued and located my host machine. This part still unclear for me.
    – aze2201
    May 6, 2020 at 22:59
  • They don't issue the same certificate, they issue a different certificate for the same domain. Like if you moved hosting providers, the new provider would be able to issue a new certificate for the domain. Or if you sold the domain without selling the server, the new owner would setup a new server and get a new certificate for the domain.
    – Z.T.
    May 6, 2020 at 23:00
  • You point the domain to clooudflare. Now they control the domain. They can give your browser any IP address for the domain. They can place any website with any content on the domain. They have full control. Their business is that you trust them to only give browsers data that you approve of, taken from your origin server and potentially processed by cloudflare. They are between the client and your server for all connections. The client never connects to your server directly. Your server can be configured so that only Cloudflare's server can connect to it, no browser can connect to it.
    – Z.T.
    May 6, 2020 at 23:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .