What is the difference between Cloudflare's Flexible, Full, and Full (Strict) SSL modes?

Flexible SSL encrypts traffic only between the visitor and Cloudflare, leaving the connection between Cloudflare and your origin server unencrypted (not recommended). Full SSL encrypts traffic end-to-end but doesn't verify the origin server's certificate. Full (Strict) SSL encrypts traffic end-to-end AND verifies that your origin server has a valid, trusted SSL certificate, making it the most secure option. Always use Full (Strict) for production environments.

How long does it take for Cloudflare DNS changes to propagate?

Cloudflare DNS changes typically take effect within 1-5 minutes, but full global propagation can take up to 24-48 hours due to DNS TTL (Time to Live) caching by ISPs and resolvers. The TTL value you set on your records determines how long resolvers cache the old information before checking for updates.

Do I need to keep my hosting provider's SSL certificate if I'm using Cloudflare?

If you're using Full or Full (Strict) SSL mode, yes, you need a valid SSL certificate on your origin server. You can either purchase one, use Let's Encrypt (free), or use Cloudflare's free Origin Certificate. If you're using Flexible SSL, your origin server doesn't need SSL, but this mode is not recommended for security reasons.

Can I use Cloudflare with an existing CDN or hosting provider?

Yes, but you need to be careful about CDN chaining. If your hosting provider already has a CDN, you may create conflicts. It's generally better to choose one CDN provider. However, Cloudflare can work with most hosting providers as long as DNS records are properly configured and origin servers are accessible.

Why is my site showing a 521 or 522 error after setting up Cloudflare?

Error 521 means the origin server is down or blocking Cloudflare's requests. Error 522 means the connection timed out between Cloudflare and the origin server. Common causes include: origin server is offline, firewall blocking Cloudflare IP ranges, SSL mismatch between Cloudflare and origin, or incorrect DNS settings. Check that your origin server is online, allowlist Cloudflare IPs in your firewall, and ensure SSL settings match on both ends.

What is a Cloudflare Origin Certificate and how do I install it?

A Cloudflare Origin Certificate is a free SSL certificate issued by Cloudflare that is installed on your origin server to encrypt traffic between Cloudflare and your server. To install it, generate one in the Cloudflare dashboard under SSL/TLS > Origin Server, then install the certificate and private key on your web server (Apache, Nginx, etc.). These certificates are valid for 15 years but only trusted by Cloudflare, so they only work when Cloudflare is proxying your traffic.

Should I enable DNSSEC with Cloudflare?

Yes, enabling DNSSEC adds a critical security layer that prevents DNS spoofing attacks. To enable it, go to DNS settings in Cloudflare and follow the instructions to add a DS record to your domain registrar. Both your registrar and Cloudflare must support DNSSEC for this to work.

Can I use Cloudflare's free plan for commercial websites?

Yes, Cloudflare's free plan includes DNS, basic SSL, and DDoS protection, which is suitable for many small to medium commercial websites. However, larger businesses or those requiring advanced features like 24/7 support, advanced DDoS protection, or image optimizations may benefit from paid plans (Pro, Business, or Enterprise).

How to Configure Cloudflare DNS and SSL: Step‑by‑Step Guide

Introduction to Cloudflare DNS and SSL

What is Cloudflare DNS?

Cloudflare DNS is a globally distributed name‑resolution service that answers queries from any corner of the internet in milliseconds. By pointing your domain’s authoritative nameservers to Cloudflare, you let its network store and serve your DNS records, reducing latency and protecting against cache‑poisoning attacks.

How Cloudflare SSL Works

When Cloudflare sits in front of your site, it terminates TLS connections at the edge, presents a public certificate to visitors, and then creates a second TLS tunnel to your origin server. The two tunnels can be configured in several modes—Flexible, Full, and Full (Strict)—each determining how much of the traffic is encrypted and whether the origin’s certificate is validated.

Benefits of Using Cloudflare for Security and Speed

Instant DDoS mitigation on the network edge.
Automatic HTTP/2, HTTP/3, and Brotli compression.
Free Universal SSL that covers the entire domain.
DNSSEC signing to stop spoofed responses.
Integrated WAF, rate limiting, and bot management (available on paid plans).

Prerequisites for Cloudflare Setup

Sunlight casts shadows on a rustic brick staircase with iron railing in Baku. — Photo by Fakhri Baghirov via Pexels. How To Configure Cloudflare Dns And Ssl Step By Step Guide.

Active Domain Registration

You need a domain that is currently registered and resolving. If the domain is about to expire, renew it first.

Access to Your Domain Registrar Account

Changing nameservers requires login credentials for the registrar where you bought the domain (e.g., GoDaddy, Namecheap, Google Domains).

A Cloudflare Account

Create a free account at dash.cloudflare.com. The free tier already includes DNS, Universal SSL, and basic DDoS protection, which is enough for most small‑to‑medium sites.

Step‑by‑Step Guide to Configuring Cloudflare DNS

Adding Your Website to Cloudflare

Log in to the Cloudflare dashboard.
Click Add a Site and type your domain name.
Select a plan (Free is fine for the tutorial) and click Continue.

Scanning and Importing Existing DNS Records

Cloudflare automatically pulls A, AAAA, CNAME, MX, TXT, and other records from your current nameservers. Review the list carefully:

Make sure the www CNAME points to your root domain.
Confirm that MX records for email remain unchanged.
If you see any stale or duplicate entries, delete them now.

Updating Your Nameservers at the Registrar

Cloudflare will show two nameservers, for example anna.ns.cloudflare.com and bob.ns.cloudflare.com. Log in to your registrar and replace the existing nameservers with these values. Save the changes.

Verifying DNS Propagation

Propagation can be checked with dig or an online tool:

dig +short @1.1.1.1 example.com

If the answer shows Cloudflare’s IP addresses, the switch is live. Remember that caches may still hold the old values for the TTL you set on each record.

How to Configure Cloudflare SSL/TLS Settings

A dimly lit underground staircase offering a minimalist and moody atmosphere. — Photo by Thomas balabaud via Pexels. How To Configure Cloudflare Dns And Ssl Step By Step Guide.

Understanding SSL/TLS Encryption Modes

Mode	Encryption Path	Certificate Validation
Flexible	Visitor ⇢ Cloudflare (TLS) → Origin (HTTP)	None
Full	Visitor ⇢ Cloudflare (TLS) → Origin (TLS)	Self‑signed or expired cert accepted
Full (Strict)	Visitor ⇢ Cloudflare (TLS) → Origin (TLS)	Valid, trusted cert required

Choosing Between Flexible, Full, and Strict Modes

For production sites, pick Full (Strict). It guarantees end‑to‑end encryption and forces the origin to present a certificate that Cloudflare trusts. If your server lacks a certificate, generate a free Cloudflare Origin Certificate (see next step) and install it.

Enabling “Always Use HTTPS”

Navigate to SSL/TLS → Edge Certificates.
Toggle Always Use HTTPS to On.
Cloudflare will issue 301 redirects from HTTP to HTTPS for every request.

Configuring HSTS for Enhanced Security

HTTP Strict Transport Security tells browsers to remember that your site only works over HTTPS.

In the same Edge Certificates panel, enable HTTP Strict Transport Security (HSTS).
Set Max‑Age to at least 31536000 (one year).
Check Include subdomains if every sub‑domain serves HTTPS.
Optionally enable Preload and submit hstspreload.org once you’re confident the setting works.

Cloudflare DNS and SSL Best Practices

Managing the Proxy (Orange Cloud) vs. DNS‑Only

The orange cloud icon means Cloudflare proxies traffic, applying its security, caching, and SSL features. The gray cloud (DNS‑Only) only resolves the name; traffic goes straight to the origin. Use the proxy for any service you want protected—websites, APIs, and even some SaaS endpoints. Keep email‑related records (MX, SPF, DKIM) DNS‑Only to avoid interference.

Optimizing TTL (Time to Live) Settings

During migration, set TTL to 300 seconds (5 minutes) so changes propagate quickly. After the site stabilizes, raise TTL to 3600 or 86400 seconds to reduce query load on Cloudflare’s authoritative servers.

Using Cloudflare’s Edge Certificates

Cloudflare issues a “Universal SSL” certificate automatically. If you need a wildcard, custom SAN, or EV certificate, upgrade to Advanced Certificate Manager. For most sites, the default covers example.com and *.example.com.

Installing a Cloudflare Origin Certificate

Generate the certificate in SSL/TLS → Origin Server. Choose a 15‑year validity and the PEM format. Then copy the two files to your server:

# Example for Nginx sudo mkdir -p /etc/ssl/cloudflare sudo tee /etc/ssl/cloudflare/origin.pem <<EOF -----BEGIN CERTIFICATE----- YOUR_ORIGIN_CERTIFICATE_CONTENT -----END CERTIFICATE----- EOF sudo tee /etc/ssl/cloudflare/origin.key <<EOF -----BEGIN PRIVATE KEY----- YOUR_PRIVATE_KEY_CONTENT -----END PRIVATE KEY----- EOF # Update Nginx config sudo sed -i 's|ssl_certificate .*|ssl_certificate /etc/ssl/cloudflare/origin.pem;|' /etc/nginx/sites-available/default sudo sed -i 's|ssl_certificate_key .*|ssl_certificate_key /etc/ssl/cloudflare/origin.key;|' /etc/nginx/sites-available/default sudo systemctl reload nginx

Because the certificate is trusted only by Cloudflare, it will not cause browser warnings as long as the orange cloud remains active.

Enabling DNSSEC

Go to DNS → DNSSEC and click Enable DNSSEC.
Copy the DS record Cloudflare generates.
Log in to your registrar, locate the DNSSEC section, and paste the DS record.
Save and wait for the chain of trust to propagate (usually under an hour).

Using Page Rules for HTTPS Enforcement and Canonical Redirects

Page Rules let you force https://example.com and redirect www to the non‑www version (or vice‑versa) without touching your web server:

# Example Page Rule URL pattern: http://*example.com/* Setting: Forwarding URL (301) → https://example.com/$2

Common Mistakes and Troubleshooting

Fixing “Too Many Redirects” Errors

These usually happen when the origin server redirects HTTP→HTTPS while Cloudflare also forces HTTPS. Resolve it by:

Ensuring the origin does not issue its own HTTPS redirect (disable any .htaccess or server‑level redirects).
Leaving Always Use HTTPS enabled in Cloudflare.

Resolving DNS Propagation Delays

If dig still shows the old nameservers after 30 minutes, check:

TTL values on the old records (high TTL can lock caches).
Whether the registrar accepted the new nameserver list (some require verification).

Handling SSL Handshake Failures

Typical causes:

Origin server presents an expired or mismatched certificate while Cloudflare is set to Full (Strict). Replace the cert with a valid one or a Cloudflare Origin Certificate.
Firewall blocks Cloudflare IP ranges. Add the following CIDR blocks to the allowlist (see cloudflare.com/ips):

# Example iptables rule sudo iptables -I INPUT -p tcp -s 173.245.48.0/20 -j ACCEPT

How to Configure Cloudflare DNS and SSL: Step-by-Step Guide