How to Use Cloudflare SSL Certificate, Get & Install Free SSL Easily 2026

Logging in drops you on Account home, which lists every domain on the account under Domains along with quick analytics for security insights, cache rate, and web traffic. Each domain in that list is where you'll dig into SSL settings; clicking a domain name takes you into that zone's own dashboard rather than a shared account-wide SSL setting, since encryption is configured per domain.

Inside a domain, the SSL/TLS section in the left sidebar expands into Overview, Edge Certificates, Client Certificates, Origin Server, and Custom Hostnames. The Overview page shows a diagram of the full connection path, browser to Cloudflare to origin server, with a padlock on each hop, and states your current encryption mode at the top. Cloudflare actually offers five modes, not the two or three most walkthroughs cover: Off, which encrypts nothing; Flexible; Full; Full (Strict); and a fifth mode, Strict (SSL-Only Origin Pull), that behaves a little differently from Full Strict even though the names invite confusion.

Flexible only encrypts the browser-to-Cloudflare leg and leaves the connection to your origin server unencrypted. It's a stopgap, not a long-term setting for anything handling real traffic.

Full encrypts both legs but accepts a self-signed or otherwise invalid certificate on the origin. Full (Strict) requires the origin to present a certificate Cloudflare actually trusts, matching whichever protocol the visitor used to reach Cloudflare in the first place.

Strict (SSL-Only Origin Pull) is the outlier: it always connects to the origin over HTTPS with certificate validation, regardless of whether the visitor's own request came in over HTTP or HTTPS. For most sites, Full (Strict) is the one worth aiming for if your host supports installing a certificate there.

Under SSL/TLS → Origin Server, the Origin Certificate Installation page walks through creating a private key and Certificate Signing Request. You can let Cloudflare generate both in your browser, or supply your own CSR if your host requires it.

The form lets you choose RSA or ECC for the key type, lists the hostnames the certificate covers (your domain and its first-level wildcard, automatically), and lets you set a validity period of up to fifteen years. One gap worth knowing about before you set a long validity period: Cloudflare doesn't send expiration reminders for Origin CA certificates. Whatever date you pick is on you to track.

Clicking Create generates the certificate and private key, shown once. Copy both immediately; the private key isn't stored anywhere for you to retrieve again.

Where you install them depends on your hosting stack: a control panel like cPanel usually has a dedicated SSL section to paste the certificate and key, while a server you manage directly means configuring Nginx or Apache to reference the certificate files. Once installed and the origin trusts that certificate, switch the encryption mode on the Overview page to Full (Strict).

With Strict mode in place, head to Edge Certificates to turn on Always Use HTTPS, which redirects any HTTP request to HTTPS automatically, and Automatic HTTPS Rewrites, which fixes links to your own resources that are hardcoded to load over HTTP. Load your live domain afterward and check for the padlock, then run it through an external SSL scanning tool for a second opinion; those tools catch configuration issues, like an incomplete certificate chain, that the padlock alone won't show.