12

Cloudflare lets you serve your site over SSL without having to purchase and install a security certificate, a product they call “Flexible SSL”. (They act as a proxy and serve your site over SSL from their servers, while the connection from your server to theirs remains unencrypted.)

They currently offer Flexible SSL for free.

With Google's announcement that HTTPS is now a ranking signal, I'm considering switching several sites to Cloudflare, buying a Pro account, and turning on their “Flexible SSL” option, because it seems like the easiest way to serve several sites over HTTPS without having to purchase and manage multiple certificates.

Is there any downside to Cloudflare's Flexible SSL?

I'm comfortable using Cloudflare as a proxy – I'm more interested in two factors:

  1. The experience for end-users. (e.g. Will visitors see security warnings?)
  2. The level of security offered. (Enough for a simple blog, but not for an online shop because they'd pass credit card data from their server to yours unencrypted?)
Improve this question
3
  • If security is a concern, I would probably use a StartSSL free level 01 SSL certificate. For anything else (such as giving an impression to Google that the connection is secure, especially in light of the fact that use of SSL is now a ranking factor) Flexible SSL should be an easy and cheap option.
    – Rana Prathap
    Aug 11, 2014 at 18:35
  • In my opinion, one disadvantages is the price. A cheap SSL certificate costs you 5$ per year.
    – Ka Rl
    Aug 13, 2014 at 8:21
  • @KaRl this is a free service, so the price shouldn't be considered a disadvantage.
    – Andrew Lott
    Sep 7, 2015 at 10:06

3 Answers 3

Reset to default
7

Flexible SSL is NOT fully secure

CloudFlare's Flexible SSL provides encryption from the user to CloudFlare's servers, but not from their servers to the website server. This avoids the hassle of installing (and renewing) a certificate on your web server, but does mean traffic gets sent plain text over the 2nd half of the journey.

Cloudflare Flexible SSL

The benefits of this setup are:

  • Easy to get started, no need to install certificates on your web server and deal with the periodic renewals
  • Provides protection from eavesdropping on insecure WiFi connections (internet cafes) and others on your local network or at the ISP level.
  • Users will see a green padlock in their browser and should not receive any security warnings

The inherent problems are:

  • Traffic from CloudFlare to your server is not encrypted, meaning wholesale ISPs, trunk providers, and the NSA can still read all requests in plain-text
  • The traffic is subject man-in-the-middle (MITM) attacks where another server can impersonate your server and receive its traffic (although this issue also applies to the "Full" SSL setting, you'll need "Strict" mode to avoid this).
  • Because of the above, it provides a misleading and false sense of security to your web site visitors (but that's a rant not appropriate for this venue)

Comparison of the SSL settings

CloudFlare SSL settings

Not encrypting traffic between a proxy and backend server is common when the traffic is sent over a private, secured network. But in this case, you are routing traffic over the public internet.

CloudFlare recommends that you also install a certificate on your web server for true end-to-end encryption, and even provide free certificates via their dashboard for doing so (if you don't want to install a self-signed certificate). From the discussion on the CloudFlare Blog:

Actually, we'll be providing a free certificate that's pinned to the domain that you can install on your server for end-to-end crypto.

Whether "Full" or "Flexible" SSL is used, your users should not see a pop-up or other warnings.

Improve this answer
4
  • Thanks, Jeff. My understanding is that Flexible SSL does negate the need for a certificate – you are not obliged to install one on your own server, so I'm not sure the first part of your answer is correct. It seems that Cloudflare are just saying that, for customers who want it, they will be offering a free certificate as an optional extra to enable full end-to-end encryption instead of the Flexible SSL setup where only one half of the journey is encrypted. If you're able to edit your answer to reflect that I'll happily mark it as accepted. If I've misinterpreted, let me know!
    – Nick
    Aug 12, 2014 at 10:44
  • 1
    I've updated my answer. There are actually 2 locations which SSL can be used. The FlexibleSSL negates the need of an SSL certificate on the origin server. CloudFlare will be providing the SSL certificate for free on their caching servers. So we are actually both right (or both wrong depending on your perspective).
    – jeffatrackaid
    Aug 12, 2014 at 18:03
  • 1
    Jeff, I suggested an edit to your answer to add in some diagrams, and ended up restructuring the whole answer to make it clearer and flow better. I hope that's OK and I hope I didn't change your intent.
    – Simon East
    Aug 11, 2016 at 2:57
  • 1
    @SimonEast Superlative edit, one of the best I've seen here. Of course it was good to receive an answer directly from Damon at CloudFlare too.
    – dan ♦
    Aug 11, 2016 at 4:55
3

This link explains what the CloudFlare SSL options are.

Flexible SSL, at least at this time, does not fully encrypt to your server. The issue being discussed on the blog by Matthew ("Actually, we'll be providing a free certificate that's pinned to the domain that you can install on your server for end-to-end crypto.... for free") isn't available just yet.

We'll most certainly update the content to reflect any changes when we roll out the free SSL option.

Improve this answer
1
  • Thanks for this, Damon. I visited that CloudFlare page before posting my question, but for some reason it only contained the image at the time – not the text below with the warning about Flexible SSL. It does help to clarify things, though – thanks.
    – Nick
    Aug 13, 2014 at 9:36
-1

There's one big SEO disadvantage. Google said that it favors SSL sites but the certificate should be 2048 bit CloudFlare's "flexible SSL" is not 2048 bit.

Improve this answer
2
  • 1
    These are currently being issued as EC 256, which is a different method of encryption than RSA 2048. It will be at least as secure and won't have any effect on SEO.
    – Andrew Lott
    Sep 7, 2015 at 10:13
  • Yes, guess they changed this...
    – Alex
    Sep 11, 2015 at 7:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.