{"id":1482,"date":"2025-12-21T04:28:06","date_gmt":"2025-12-21T04:28:06","guid":{"rendered":"https:\/\/www.woodcentral.com\/-\/peter\/?p=1482"},"modified":"2026-05-24T11:28:10","modified_gmt":"2026-05-24T11:28:10","slug":"about-ssl-tls-certificates","status":"publish","type":"post","link":"https:\/\/www.woodcentral.com\/-\/peter\/about-ssl-tls-certificates\/","title":{"rendered":"About SSL\/TLS certificates"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">An SSL certificate is a digital certificate that enables encrypted communication between a user\u2019s web browser and a website\u2019s server. In practical terms, it ensures that data exchanged\u2014such as passwords, form submissions, or payment details\u2014cannot be easily read or altered by third parties while in transit.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">More precisely:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>SSL (Secure Sockets Layer)<\/strong> is the older name for the technology; today it is almost always implemented as <strong>TLS (Transport Layer Security)<\/strong>, but the term \u201cSSL certificate\u201d remains common.<\/li>\n\n\n\n<li>The certificate is issued by a <strong>Certificate Authority (CA)<\/strong>, which verifies the identity of the website owner to some degree.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">An SSL\/TLS certificate serves three main purposes:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Encryption<\/strong><br>It encrypts data sent between the browser and the server, protecting it from eavesdropping or interception.<\/li>\n\n\n\n<li><strong>Authentication<\/strong><br>It confirms that the website is actually operated by the entity it claims to represent, helping prevent impersonation and \u201cman-in-the-middle\u201d attacks.<\/li>\n\n\n\n<li><strong>Integrity<\/strong><br>It ensures that data is not modified in transit without detection.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">You can tell a site is using an SSL\/TLS certificate when:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The URL begins with <code>https:\/\/<\/code> rather than <code>http:\/\/<\/code><\/li>\n\n\n\n<li>A padlock icon appears in the browser\u2019s address bar<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">There are different validation levels:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>DV (Domain Validation):<\/strong> Confirms control of the domain only<\/li>\n\n\n\n<li><strong>OV (Organization Validation):<\/strong> Confirms the organization behind the site<\/li>\n\n\n\n<li><strong>EV (Extended Validation):<\/strong> Provides the highest level of identity verification<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In modern web usage, an SSL\/TLS certificate is effectively mandatory. Browsers now warn users when a site lacks one, and many features (such as HTTP\/2, modern authentication, and search engine ranking benefits) require HTTPS.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An SSL\/TLS certificate can be used at <strong>both the CDN edge (Cloudflare)<\/strong> and <strong>the origin server<\/strong>, and the two layers serve different but complementary roles. Understanding this distinction is important for security, performance, and operational clarity.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">1. SSL\/TLS at the Cloudflare CDN level (Edge Certificates)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When Cloudflare is in front of your site, <strong>clients connect to Cloudflare, not directly to your server<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How it works<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A visitor\u2019s browser establishes an HTTPS connection <strong>to Cloudflare\u2019s edge server<\/strong>.<\/li>\n\n\n\n<li>Cloudflare presents an SSL\/TLS certificate issued for your domain.<\/li>\n\n\n\n<li>Traffic is encrypted between the browser and Cloudflare.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What Cloudflare provides<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Universal SSL certificates<\/strong> (typically DV) at no extra cost.<\/li>\n\n\n\n<li>Automatic certificate issuance and renewal.<\/li>\n\n\n\n<li>Support for modern TLS versions and ciphers.<\/li>\n\n\n\n<li>Global termination of TLS close to the user, improving latency.<\/li>\n\n\n\n<li>Protection against common attacks (MITM, downgrade attacks, etc.).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What this protects<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Data in transit <strong>between the end user and Cloudflare<\/strong>.<\/li>\n\n\n\n<li>Prevents browsers from seeing an unencrypted or untrusted connection.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Important implication<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">At this point, traffic is <strong>decrypted at Cloudflare<\/strong> so it can:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cache content<\/li>\n\n\n\n<li>Apply firewall rules<\/li>\n\n\n\n<li>Perform bot detection and rate limiting<\/li>\n\n\n\n<li>Optimize or modify responses (compression, minification, etc.)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This is why Cloudflare is often described as a \u201creverse proxy.\u201d<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">2. SSL\/TLS between Cloudflare and the origin server<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is the <strong>second hop<\/strong>: Cloudflare \u2192 your web server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cloudflare offers several SSL modes that control how this connection is handled.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Common modes<\/h3>\n\n\n\n<h4 class=\"wp-block-heading\">Flexible SSL (not recommended)<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Browser \u2194 Cloudflare: HTTPS<\/li>\n\n\n\n<li>Cloudflare \u2194 origin: HTTP (unencrypted)<\/li>\n\n\n\n<li>Your server does <strong>not<\/strong> need a certificate.<\/li>\n\n\n\n<li>Vulnerable to attacks on the Cloudflare\u2013origin leg.<\/li>\n\n\n\n<li>Can break applications that expect HTTPS end-to-end.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Full SSL<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Browser \u2194 Cloudflare: HTTPS<\/li>\n\n\n\n<li>Cloudflare \u2194 origin: HTTPS<\/li>\n\n\n\n<li>Origin certificate can be self-signed.<\/li>\n\n\n\n<li>Traffic is encrypted but <strong>not authenticated<\/strong> at the origin.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Full (Strict) SSL (best practice)<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Browser \u2194 Cloudflare: HTTPS<\/li>\n\n\n\n<li>Cloudflare \u2194 origin: HTTPS<\/li>\n\n\n\n<li>Origin must have a <strong>valid certificate<\/strong> trusted by Cloudflare.<\/li>\n\n\n\n<li>Provides encryption <strong>and<\/strong> authentication end-to-end.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">3. SSL\/TLS on the local (origin) server<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Purpose<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The local certificate secures traffic <strong>from Cloudflare to your server<\/strong> and ensures Cloudflare is talking to the correct origin.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Certificate options<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Public CA certificate<\/strong> (Let\u2019s Encrypt, etc.)<\/li>\n\n\n\n<li><strong>Cloudflare Origin Certificate<\/strong>\n<ul class=\"wp-block-list\">\n<li>Issued by Cloudflare<\/li>\n\n\n\n<li>Trusted only by Cloudflare (not browsers)<\/li>\n\n\n\n<li>Long validity (up to 15 years)<\/li>\n\n\n\n<li>Ideal when Cloudflare is always in front<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">What the origin certificate does<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Encrypts traffic from Cloudflare to your server<\/li>\n\n\n\n<li>Prevents traffic interception within your hosting provider or data center<\/li>\n\n\n\n<li>Allows use of <strong>Full (Strict)<\/strong> mode<\/li>\n\n\n\n<li>Supports secure headers, HSTS, and HTTPS-only applications<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">4. Typical best-practice configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For a site like yours that already uses Cloudflare heavily:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Cloudflare Edge<\/strong>\n<ul class=\"wp-block-list\">\n<li>Enable Universal SSL<\/li>\n\n\n\n<li>Force HTTPS<\/li>\n\n\n\n<li>Use modern TLS settings<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Origin Server<\/strong>\n<ul class=\"wp-block-list\">\n<li>Install a Cloudflare Origin Certificate <em>or<\/em> Let\u2019s Encrypt<\/li>\n\n\n\n<li>Configure the web server to listen on HTTPS only<\/li>\n\n\n\n<li>Redirect or block plain HTTP<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Cloudflare SSL Mode<\/strong>\n<ul class=\"wp-block-list\">\n<li>Set to <strong>Full (Strict)<\/strong><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">This results in:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Encrypted traffic from browser \u2192 Cloudflare \u2192 origin<\/li>\n\n\n\n<li>Authentication at both layers<\/li>\n\n\n\n<li>No browser warnings<\/li>\n\n\n\n<li>Minimal certificate maintenance overhead<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">5. Why both layers matter<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Layer<\/th><th>Without SSL<\/th><th>With SSL<\/th><\/tr><\/thead><tbody><tr><td>Browser \u2192 Cloudflare<\/td><td>Browser warnings, exposed data<\/td><td>Secure, trusted connection<\/td><\/tr><tr><td>Cloudflare \u2192 Origin<\/td><td>Vulnerable inside hosting network<\/td><td>Encrypted and authenticated<\/td><\/tr><tr><td>Application logic<\/td><td>HTTPS assumptions break<\/td><td>Modern security features work<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">In short, <strong>Cloudflare\u2019s certificate protects your users<\/strong>, while <strong>the origin certificate protects your infrastructure and ensures end-to-end security<\/strong>. Using both is now considered standard practice rather than optional.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>An SSL certificate is a digital certificate that enables encrypted communication between a user\u2019s web browser and a website\u2019s server. In practical terms, it ensures that data exchanged\u2014such as passwords, form submissions, or payment details\u2014cannot be easily read or altered by third parties while in transit. More precisely: An SSL\/TLS certificate serves three main purposes: &#8230; <a title=\"About SSL\/TLS certificates\" class=\"read-more\" href=\"https:\/\/www.woodcentral.com\/-\/peter\/about-ssl-tls-certificates\/\" aria-label=\"Read more about About SSL\/TLS certificates\">Read more<\/a><\/p>\n","protected":false},"author":7,"featured_media":1485,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-1482","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/posts\/1482","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/comments?post=1482"}],"version-history":[{"count":0,"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/posts\/1482\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/media\/1485"}],"wp:attachment":[{"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/media?parent=1482"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/categories?post=1482"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.woodcentral.com\/-\/peter\/wp-json\/wp\/v2\/tags?post=1482"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}