1. I want to use Cloudflare CDN/HTTP proxy for my web-site that already has HTTPS through LetsEncrypt certificate.
  2. I don't want to use Cloudflare's Free SSL certificate as it doesn't work on WindowsXP and some old browsers. Neither I want to upgrade the plan to pay monthly fees.
  3. If I turn on Cloudflare proxying without enabling their SSL, it keeps redirecting my web-site from HTTPS to HTTP. If I turn on their SSL, I end-up with the limitations of their free SSL certificates.

So, is there a walkaround to use own SSL certificates and benefit from Cloudflare optimizations, CDN, etc.?

  • I don't know what exactly is possible with their service. But what would technically be possible depends on whether you want them to MITM the traffic or not. Also keep in mind, that clients which support neither SNI nor IPv6 are becoming increasingly difficult to support. Such clients will probably soon start losing access to some sites - if it is not already happening. – kasperd Apr 28 '16 at 12:44
  1. Yes, the browser will do HTTPS over HTTP2 to CloudFlare, then they will use HTTPS to your origin server.

  2. This rules out CloudFlare for you. Either accept XP can't access the site or pay for the additional feature.

  3. Yes, that's right.

No, there's no way to do what you want to do, within the constraints you've placed. CloudFlare must terminate the browser session, and if you disable HTTPS it will be HTTP. If you want to use CloudFlare you need to change your requirements or constraints.

  • Thank you! I see there is a need to upgrade the account to still benefit from their CDN and security features. – user1537407 Apr 30 '16 at 3:14
  • That's correct. If you want universal SSL and Windows XP support you need to pay for their business plan. XP is still 10% of browsers, so it's significant, but they're probably used to not being able to get to some websites. You can just use http. You could consider using CloudFront, or one of the other CDNs, but they're all paid. – Tim Apr 30 '16 at 11:36

In Crypto SSL Settings turn Set SSL To Full or just turn it off.

  • 1
    Full requires a valid SSL certificate to encrypt the connection between CloudFlare and the origin server. Off uses unencrypted http between CloudFlare and the origin server. There are other options not mentioned by @ashish, covered by the documentation here support.cloudflare.com/hc/en-us/articles/… – Tim Feb 11 '17 at 8:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.