Knowledge Base
Using SSL with CloudFlare
This article discusses various options for using SSL on a CloudFlare-enabled account.
Using CloudFlare with an SSL certificate
To provide secure connections for your users, you must install an SSL certificate on your site. When you have an SSL certificate installed and CloudFlare enabled on your site, the entire connection is encrypted, from the browser to CloudFlare to your web server.
SSL-enabled root domains
If you have SSL enabled for your root domain (for example, example.com), you must upgrade to CloudFlare Pro to use SSL and CloudFlare simultaneously.
CloudFlare provides two options for SSL-enabled sites:
- Full SSL: For this option, you need at least a self-signed SSL certificate. For information about how to generate and install a self-signed certificate, please see this article.
If you disable CloudFlare for your site, the self-signed SSL certificate is “exposed” to web visitors. They will receive warnings in their browsers that the certificate is not trusted. To prevent this scenario from occurring, you should purchase a valid SSL certificate signed by a Certificate Authority.
- Full SSL (strict): For this option, you need a valid SSL certificate signed by a Certificate Authority. This is the preferred method, because even if you disable CloudFlare for your site, it is still completely protected by the SSL certificate.
- To view the various SSL certificates available at A2 Hosting, please visit http://www.a2hosting.com/ssl-hosting.
- For general information about SSL and how to install an SSL certificate, please see these articles.
SSL-enabled subdomains
If you have SSL enabled for a subdomain, you can continue using the free version of CloudFlare on your root domain. However, you must make sure that the SSL-enabled subdomain is disabled (has the gray cloud icon 
next to it) in your CloudFlare settings. For more information about how to configure CloudFlare for your account, please see this article.
If you want to use CloudFlare with an SSL-enabled subdomain, you must upgrade to CloudFlare Pro.
Using CloudFlare without an SSL certificate
If your site does not currently have an SSL certificate, you can use CloudFlare Universal SSL. This feature is free, and encrypts connections between users' web browsers and CloudFlare. Connections between CloudFlare and your web site, however, are not encrypted. To secure the entire connection, you must install an SSL certificate on your server.
For more information about CloudFlare Universal SSL, please visit http://blog.cloudflare.com/introducing-universal-ssl.
- Universal SSL is only available if you sign up for CloudFlare directly at their site. You currently cannot use Universal SSL if you configure CloudFlare through cPanel.
- The Universal SSL option only works in modern browsers that support Server Name Indication (SNI). Approximately 80% of browsers currently in use support SNI. For information about which browsers support CloudFlare Universal SSL, please visit https://support.cloudflare.com/hc/en-us/articles/203274000-Does-CloudFlare-s-free-Universal-SSL-have-limitations-.
- You should not use Universal SSL if your website processes any sensitive information, such as payment data or personally identifiable information (PII). While Universal SSL is better than nothing, to really secure your site and protect your users, you must install an SSL certificate.
