Cloudflare Docs

Cloudflare Docs

Overview
Concepts
Get started
Edge certificates
Universal SSL
Enable Universal SSL certificates
Disable Universal SSL certificates
Limitations
Troubleshooting
Advanced certificates
Manage advanced certificates
API commands
Custom certificates
Manage custom certificates
Renewal and expiration
Bundle methodologies
Remove key file password
Enforce HTTPS connections
Domain Control Validation (DCV)
Methods
Delegated
TXT
Email
HTTP
Troubleshooting
Geo Key Manager
Setup
Supported options
Staging environment (Beta)
Add CAA records
Backup certificates
Troubleshooting
Certification Authority Authorization (CAA) FAQ
Additional options
Certificate Transparency Monitoring
HTTP Strict Transport Security (HSTS)
Certificate Signing Requests (CSRs)
TLS 1.3
Minimum TLS Version
Automatic HTTPS Rewrites
Total TLS
Enable
Error messages
Always Use HTTPS
Opportunistic Encryption
Origin server
Encryption modes
Off (no encryption)
Flexible
Full
Full (strict)
Strict (SSL-Only Origin Pull)
SSL/TLS Recommender
Origin CA certificates
Authenticated Origin Pulls (mTLS)
About
Setup
Zone-level
Per-hostname
Custom Origin Trust Store
Cipher suites
Keyless SSL
Get started
Cloudflare Tunnel
Public DNS
Hardware security modules
Configuration
AWS cloud HSM
Azure Dedicated HSM
Azure Managed HSM
SoftHSMv2
Entrust nShield Connect
IBM cloud HSM
Google Cloud HSM
Upgrade your key server
Reference
High availability
Scaling and benchmarking
Keyless delegation
Troubleshooting
Client certificates
Create a client certificate
Configure your mobile app or IoT device
Enable mTLS
Revoke a client certificate
Troubleshooting
Mutual authentication
SSL for SaaS
Reference
Cipher suites
Recommendations
Supported cipher suites
Customize cipher suites
Compliance status
Custom certificates
Match on origin
Troubleshooting
TLS protocols
Certificate and hostname priority
Certificate authorities
Browser compatibility
Migration guides
Changes to HTTP DCV
DigiCert update
Universal certificates
Advanced certificates
Custom hostnames
Certificate pinning
Certificate statuses
Validation backoff schedule
Validity periods
Troubleshooting
ERR_SSL_VERSION_OR_CIPHER_MISMATCH
ERR_TOO_MANY_REDIRECTS

Reference

For more on Cloudflare SSL/TLS, refer to these articles:

Cipher suites: Consider information about supported cipher suites, how to meet your security requirements, and how to troubleshoot compatibility and other issues.
TLS protocols: Cloudflare supports a variety of TLS protocols, ranging from TLS 1.0 to TLS 1.3.
Certificate and hostname priority: Learn about how Cloudflare decides which certificate (and the associated SSL/TLS settings) apply to individual hostnames.
Certificate authorities: Learn more about the certificate authorities Cloudflare uses to issue Universal, Advanced, or SSL for SaaS certificates.
Browser compatibility: Review information about browser compatibility for the different Cloudflare SSL offerings.
Migration guides: These guides walk you through the migration processes associated with various changes in Cloudflare’s SSL/TLS infrastructure.
Certificate pinning: Learn why Cloudflare does not support HTTP public key pinning (HPKP) and consider an alternative solution to prevent certificate misissuance.
Certificate statuses: Certificates statuses show which stage of the issuance process each certificate is in.
Validation backoff schedule: Consider what happens if a domain control validation (DCV) fails and what schedule Cloudflare follows for new attempts and backoff.
Validity periods: Review information about available validity periods for your Cloudflare SSL certificates.