Cloudflare’s orange cloud (proxy mode) puts Cloudflare between visitors and your server. It terminates the visitor-facing TLS connection, then opens a second connection to your origin. Get the SSL mode wrong and you either expose unencrypted traffic on that second leg, or you hit an infinite redirect loop. Here’s the setup that avoids both.

The four SSL modes

Full (Strict) is the only correct choice for production. Flexible is the one that causes the redirect loop everyone hits, and it’s worth understanding exactly why.

The redirect loop, explained

Say your origin server redirects all HTTP to HTTPS — a completely standard, reasonable thing to do. With Flexible mode, Cloudflare terminates HTTPS with the visitor, then connects to your origin over plain HTTP. Your origin sees an HTTP request, and its redirect rule fires: “redirect to HTTPS.” Cloudflare receives that redirect, and because the visitor is already on HTTPS from their side, it just sends them back to the same URL. Origin redirects again. Loop.

sequenceDiagram
    participant V as Visitor
    participant CF as Cloudflare
    participant O as Origin
    V->>CF: HTTPS request
    CF->>O: HTTP request
    O-->>CF: 301 redirect to HTTPS
    CF-->>V: 301 redirect to HTTPS
    V->>CF: HTTPS request again
  

The fix isn’t a clever workaround — it’s not using Flexible at all. Switch to Full (Strict) and terminate real TLS on your origin. Now Cloudflare connects via HTTPS, your origin’s “redirect HTTP to HTTPS” rule never fires because the incoming request already is HTTPS, and the loop is gone.

Setting up Full (Strict) correctly

Full (Strict) requires your origin to present a certificate Cloudflare actually trusts — not a self-signed one, and not an expired one. You have two good options.

Option 1: Cloudflare Origin CA certificate. Free, valid for up to 15 years, trusted by Cloudflare (but not by regular browsers directly — that’s fine, because browsers only ever talk to Cloudflare’s edge cert, never this one). Generate it in the dashboard under SSL/TLS → Origin Server, then install it on your origin:

ssl_certificate     /etc/nginx/ssl/cloudflare-origin.pem;
ssl_certificate_key /etc/nginx/ssl/cloudflare-origin.key;

Option 2: A normal Let’s Encrypt certificate on your origin. Works too, and has the advantage of also being valid if you ever need to bypass Cloudflare’s proxy (grey-clouding a DNS record for debugging, for instance).

Either way, set the mode:

SSL/TLS → Overview → Full (strict)

Confirm it, don’t assume it

curl -vI https://example.com 2>&1 | grep -i "subject\|issuer"

If this comes back with Cloudflare’s edge certificate, that’s the visitor-facing leg — expected, and doesn’t tell you about the origin leg. To check the origin connection directly, hit it bypassing Cloudflare:

curl -vI --resolve example.com:443:YOUR_ORIGIN_IP https://example.com

If that fails with a cert error, Full (Strict) will fail too, silently returning 526 “Invalid SSL Certificate” to every visitor. Better to catch it here than from a user report.

The other redirect loop: page rules and “Always Use HTTPS”

Even on Full (Strict), you can create a loop with a misconfigured Cloudflare Page Rule or “Always Use HTTPS” setting stacked on top of an origin-side redirect that’s checking the wrong header. If your app checks req.secure or similar to decide whether to redirect, make sure it trusts X-Forwarded-Proto from Cloudflare rather than the raw connection scheme — otherwise it can decide it’s still on HTTP even when Cloudflare connected over HTTPS, and redirect forever.

One thing to avoid

Don’t set the mode to Full (non-strict) as a “safer than Flexible, easier than Strict” middle ground and leave it there. It accepts self-signed and expired certs on the origin leg, which means that connection is encrypted but not authenticated — anyone who can intercept traffic between Cloudflare and your origin (unlikely, but not impossible on shared or cloud infrastructure) can present any certificate and go unnoticed. Strict costs you nothing extra once you have a real cert installed, so there’s no reason to stop one step short.