How to Use Cloudflare SSL Certificate, Get & Install Free SSL Easily 2026

Logging in drops you on Account home, which lists every domain on the account under Domains along with quick Analytics for security insights, cache rate, and web traffic. Each domain in that list is where you'll dig into SSL settings — clicking a domain name takes you into that specific zone's dashboard rather than a shared account-wide SSL setting, since encryption is configured per domain.

Inside a domain, the SSL/TLS section in the left sidebar expands into Overview, Edge Certificates, Client Certificates, Origin Server, and Custom Hostnames. The Overview page shows a diagram of the full connection path — Browser to Cloudflare to Origin Server — with a padlock icon on each hop, and states your Current encryption mode plainly at the top. Full is a reasonable default, but it only confirms that Cloudflare talks to your origin server over HTTPS, not that the certificate on that origin server is actually trusted, which is where Full Strict comes in.

Flexible only encrypts the browser-to-Cloudflare leg and leaves the connection to your origin server unencrypted, which is a stopgap at best and shouldn't be the long-term setting for anything handling real traffic. Full encrypts both legs but accepts a self-signed or invalid certificate on the origin. Full Strict requires the origin server to present a certificate Cloudflare actually trusts, and it's the mode worth aiming for if your host supports installing a certificate there — the Overview page's traffic chart, split into TLS v1.2, TLS v1.3, and unencrypted requests, gives you a sense of how much of your current traffic is even reaching that bar.

Under SSL/TLS → Origin Server, the Origin Certificate Installation page walks through creating a private key and Certificate Signing Request — you can let Cloudflare generate both with your browser, or supply your own CSR if your hosting provider requires it. The form lets you set the private key type (RSA 2048 is the default), lists the hostnames the certificate will cover, including your domain and its wildcard, and lets you set how long the certificate stays valid, up to fifteen years by default.

Clicking Create generates the certificate and private key, which Cloudflare displays once — copy both immediately, since the private key isn't stored for you to retrieve again later. Where you install them depends entirely on your hosting stack: a control panel like cPanel usually has a dedicated SSL section to paste the certificate and key, while a server you manage directly means configuring your web server (Nginx or Apache) to reference the certificate files. Once installed and the origin trusts that certificate, switch the encryption mode on the Overview page to Full (Strict).

With Strict mode in place, head to Edge Certificates to turn on Always Use HTTPS, which redirects any HTTP request to HTTPS automatically, and Automatic HTTPS Rewrites, which fixes links to your own resources that are hardcoded to load over HTTP. Load your live domain afterward and check for the padlock in the address bar, and run it through an external SSL scanning tool for a second opinion — those tools catch configuration issues, like an incomplete certificate chain, that the padlock alone won't reveal.