1

Hi so I read many websites that say to enable SSL on my drupal site, I need to purchase the certificate, install it on my apache server, install mod_ssl, enable it on httpd.conf, and finally configure Drupal settings.

Now I'm a paid subscriber to Cloudflare. Is it true they can setup my site with https?

What do I have to do with cloudflare to enable https on my drupal website? Thanks!

  • cloudflare.com/ssl – Stephen Ostermiller Jul 13 '17 at 9:42
  • Thing is I won't be able to install ssl certificate on my drupal server that is the origin server. So it's not full ssl for google seo purposes right? Kindly advise Thanks! – user3236765 Jul 13 '17 at 9:43
  • 1
    Cloudflare has several options for communicating between your server and theirs. You don't have to have SSL installed on your server, cloudflare can work with plain text. It says they can work with self signed certs, certs signed by them, or certs signed by a certificate authority. – Stephen Ostermiller Jul 13 '17 at 12:10
3

Yes cloudflare gives free SSL to all paid and free customers.

The things you need to do is.

  1. Add your CNAME or A records in your cloudflare DNS pannel. So if you're using www subdomain then make sure that www CNAME is added in your Cloudflare DNS pannel. So the traffic from www.example.com will pass to cloudflare server and then cloudflare sent request to your origin server.

  2. Go to crypto option and set flexible SSL option. We have chosen Flexible SSL because to use Full SSL we need to have SSL certification installed in server side as well. So now if anyone typed https://www.example.com in addressbar then cloduflare will handle that, since your browser request to cloudflare and not to your origin server(So no need to add install certificate manually in your apache server)

  3. But if user typed http://www,example.com then your site will serve without SSL and hence we need to redirect user to https website, so to do that, we will use page rules, so first go to page rules seeting and enter URL pattern like http//*.example.com/* and then choose Always HTTPS option and you're done. That URL pattern match any subdomain like https://sub.example.com and any sub directory level like https://another.example.com/some/extra/page/

  • Yes but would it suffice for google seo requirements? – user3236765 Jul 13 '17 at 10:08
  • Also I tried the steps you mentioned, but Drupal has images with http hardcoded it seems so it's not working.. the browser says some images are not secured. – user3236765 Jul 13 '17 at 10:13
  • I don't know more about drupal, but you've to enable https in your drupal as well, so the all assets(images/css/javascript) links will turned into https. Once the all links turn into https then your mix content warning will gone. I've seen people also use cloudflare SSL in wordpress as well. So I think you can also do that in drupal CMS as well. – Goyllo Jul 13 '17 at 10:16
  • This docs says you've to add https as $base_url in your setting.phpfile. Have you tried that? – Goyllo Jul 13 '17 at 10:19
  • Yep I tried the base url settings it's not working. If there are hardcoded http images files in the drupal code, how would these settings work? :-( – user3236765 Jul 13 '17 at 10:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.