1

I have a Linux shared hosting on Hostgator, and am using a Full SSL from Cloudflare which Encrypts end-to-end, using a self-signed certificate on the server.

  1. How secure is it?

  2. What are different options to enable full security if this method has any drawback?

Cloudflare has a stricter SSL option that is Full (strict) which Encrypts end-to-end, but requires a trusted CA or Cloudflare Origin CA certificate on the server, I'm not using it as of now.

1

If you don't have to ask users to send some personal info and don't have online payment function, then you don't need Full (strict) certificate.

Full SSL

As it should be evident by now, Full SSL will mean a completely secure connection. You will have a fully secure connection between your visitor and CloudFlare and also a secure connection between your web server and CloudFlare.

If you want this connectivity option to work, you need to have SSL certification on your web server. You will also need to configure your server to answer the HTTPS requests from your visitors. However, you need not have an authentic certificate as such. Even a self-signed certificate should do.

Full SSL – Strict

This is the most secure connectivity option you would ever opt for. In this connectivity option, you will have a secure SSL connection between the visitor to your site and CloudFlare in addition to a secure connection between your web server and CloudFlare as well.

The significant difference between the Full SSL connection and a Full Strict Connection is the latter would need you to have an authenticated certification installed on your web server. Your server should be configured to answer the HTTPS requests. But, the SSL certificate needs to be a valid one. A self-signed certificate will not work here. You need to go with an SSL certificate that is signed by a certificate authority. The certificate authority must be the one trusted by CloudFlare.

If you are using an SSL certificate generated and trusted by CloudFlare, you may not need to install it on your web server. You can create a self-signed certificate and make use of it on your server for an end to end encryption.

  • With full SLL, you are still vulnerable if a rouge party on the internet publishes the wrong IP range, and actually responds to that traffic (very unlikely, but easier to than on the scale of hijacking the cloudflare ip's). If you use strict ode, you are guarded against this – Ferrybig Nov 4 at 10:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.