{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/prepare-the-origin-certificate-before-switching-cloudflare-to-full-strict/", "item": { "id": "https://update.dsesecurity.com/updates/prepare-the-origin-certificate-before-switching-cloudflare-to-full-strict/", "slug": "prepare-the-origin-certificate-before-switching-cloudflare-to-full-strict", "url": "https://update.dsesecurity.com/updates/prepare-the-origin-certificate-before-switching-cloudflare-to-full-strict/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/prepare-the-origin-certificate-before-switching-cloudflare-to-full-strict.md", "json": "https://update.dsesecurity.com/api/v1/posts/prepare-the-origin-certificate-before-switching-cloudflare-to-full-strict/" }, "title": "Prepare the origin certificate before switching Cloudflare to Full strict", "summary": "The edge-to-origin connection must meet validity, issuer, and hostname requirements.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:17:02+00:00", "modified_at": "2026-10-20T18:34:37+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 268, "potentially_affected": "This concerns Cloudflare's website origin TLS mode.", "dse_recommendation": "DSE recommends inventorying every origin and hostname affected by the mode before changing it.", "primary_source": { "name": "Cloudflare — Full (strict) - SSL/TLS encryption modes", "url": "https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/full-strict/", "published_on": null, "authority": "developers.cloudflare.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

The edge-to-origin connection must meet validity, issuer, and hostname requirements.

\n

Source facts

\n

Cloudflare states that Full (strict) validates the origin certificate rather than merely encrypting that connection. The certificate must be within its validity period, issued by a publicly trusted CA or Cloudflare Origin CA, and match the requested or target hostname. The origin must accept HTTPS on the required port; failing the prerequisites can produce a 526 error.

\n

Source: Cloudflare — Full (strict) – SSL/TLS encryption modes.

\n

Applicability

\n

This concerns Cloudflare’s website origin TLS mode.

\n

DSE recommendation

\n

DSE recommends inventorying every origin and hostname affected by the mode before changing it. Install and validate the origin certificate and chain first, including renewal ownership and required network access. Check the actual target hostname used by origin routing rather than assuming it always equals the public name. Keep a tested rollback that preserves an appropriate security posture instead of leaving validation disabled as a permanent workaround. Have each origin owner approve the hostname used for the TLS validation check, including any configured target override. Keep the intended issuer and renewal contact beside that name. Require the origin prerequisites to pass before the edge setting changes rather than troubleshooting certificate eligibility after production traffic fails.

\n

Verification

\n

For each approved origin, inspect certificate name, validity, chain, and listener before enabling the mode. Then request representative public paths through Cloudflare with normal browser validation. Confirm the origin connection succeeds, review any 526 evidence, and separately verify redirects and mixed-content behavior rather than treating a single successful TLS handshake as complete website acceptance.

\n

Official reference

\n

Cloudflare — Full (strict) – SSL/TLS encryption modes. Reviewed October 20, 2026.

", "content_text": "The edge-to-origin connection must meet validity, issuer, and hostname requirements.\nSource facts\nCloudflare states that Full (strict) validates the origin certificate rather than merely encrypting that connection. The certificate must be within its validity period, issued by a publicly trusted CA or Cloudflare Origin CA, and match the requested or target hostname. The origin must accept HTTPS on the required port; failing the prerequisites can produce a 526 error.\nSource: Cloudflare — Full (strict) – SSL/TLS encryption modes.\nApplicability\nThis concerns Cloudflare’s website origin TLS mode.\nDSE recommendation\nDSE recommends inventorying every origin and hostname affected by the mode before changing it. Install and validate the origin certificate and chain first, including renewal ownership and required network access. Check the actual target hostname used by origin routing rather than assuming it always equals the public name. Keep a tested rollback that preserves an appropriate security posture instead of leaving validation disabled as a permanent workaround. Have each origin owner approve the hostname used for the TLS validation check, including any configured target override. Keep the intended issuer and renewal contact beside that name. Require the origin prerequisites to pass before the edge setting changes rather than troubleshooting certificate eligibility after production traffic fails.\nVerification\nFor each approved origin, inspect certificate name, validity, chain, and listener before enabling the mode. Then request representative public paths through Cloudflare with normal browser validation. Confirm the origin connection succeeds, review any 526 evidence, and separately verify redirects and mixed-content behavior rather than treating a single successful TLS handshake as complete website acceptance.\nOfficial reference\nCloudflare — Full (strict) – SSL/TLS encryption modes. Reviewed October 20, 2026.", "content_markdown": "The edge-to-origin connection must meet validity, issuer, and hostname requirements.\n\n## Source facts\n\nCloudflare states that Full (strict) validates the origin certificate rather than merely encrypting that connection. The certificate must be within its validity period, issued by a publicly trusted CA or Cloudflare Origin CA, and match the requested or target hostname. The origin must accept HTTPS on the required port; failing the prerequisites can produce a 526 error.\n\nSource: [Cloudflare — Full (strict) – SSL/TLS encryption modes](https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/full-strict/).\n\n## Applicability\n\nThis concerns Cloudflare’s website origin TLS mode.\n\n## DSE recommendation\n\nDSE recommends inventorying every origin and hostname affected by the mode before changing it. Install and validate the origin certificate and chain first, including renewal ownership and required network access. Check the actual target hostname used by origin routing rather than assuming it always equals the public name. Keep a tested rollback that preserves an appropriate security posture instead of leaving validation disabled as a permanent workaround. Have each origin owner approve the hostname used for the TLS validation check, including any configured target override. Keep the intended issuer and renewal contact beside that name. Require the origin prerequisites to pass before the edge setting changes rather than troubleshooting certificate eligibility after production traffic fails.\n\n## Verification\n\nFor each approved origin, inspect certificate name, validity, chain, and listener before enabling the mode. Then request representative public paths through Cloudflare with normal browser validation. Confirm the origin connection succeeds, review any 526 evidence, and separately verify redirects and mixed-content behavior rather than treating a single successful TLS handshake as complete website acceptance.\n\n## Official reference\n\n[Cloudflare — Full (strict) – SSL/TLS encryption modes](https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/full-strict/). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/prepare-the-origin-certificate-before-switching-cloudflare-to-full-strict/", "url": "https://update.dsesecurity.com/updates/prepare-the-origin-certificate-before-switching-cloudflare-to-full-strict/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/prepare-the-origin-certificate-before-switching-cloudflare-to-full-strict/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Prepare the origin certificate before switching Cloudflare to Full strict", "item": "https://update.dsesecurity.com/updates/prepare-the-origin-certificate-before-switching-cloudflare-to-full-strict/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/prepare-the-origin-certificate-before-switching-cloudflare-to-full-strict/#article", "identifier": "https://update.dsesecurity.com/updates/prepare-the-origin-certificate-before-switching-cloudflare-to-full-strict/", "url": "https://update.dsesecurity.com/updates/prepare-the-origin-certificate-before-switching-cloudflare-to-full-strict/", "headline": "Prepare the origin certificate before switching Cloudflare to Full strict", "description": "The edge-to-origin connection must meet validity, issuer, and hostname requirements.", "abstract": "The edge-to-origin connection must meet validity, issuer, and hostname requirements.", "articleBody": "The edge-to-origin connection must meet validity, issuer, and hostname requirements.\nSource facts\nCloudflare states that Full (strict) validates the origin certificate rather than merely encrypting that connection. The certificate must be within its validity period, issued by a publicly trusted CA or Cloudflare Origin CA, and match the requested or target hostname. The origin must accept HTTPS on the required port; failing the prerequisites can produce a 526 error.\nSource: Cloudflare — Full (strict) – SSL/TLS encryption modes.\nApplicability\nThis concerns Cloudflare’s website origin TLS mode.\nDSE recommendation\nDSE recommends inventorying every origin and hostname affected by the mode before changing it. Install and validate the origin certificate and chain first, including renewal ownership and required network access. Check the actual target hostname used by origin routing rather than assuming it always equals the public name. Keep a tested rollback that preserves an appropriate security posture instead of leaving validation disabled as a permanent workaround. Have each origin owner approve the hostname used for the TLS validation check, including any configured target override. Keep the intended issuer and renewal contact beside that name. Require the origin prerequisites to pass before the edge setting changes rather than troubleshooting certificate eligibility after production traffic fails.\nVerification\nFor each approved origin, inspect certificate name, validity, chain, and listener before enabling the mode. Then request representative public paths through Cloudflare with normal browser validation. Confirm the origin connection succeeds, review any 526 evidence, and separately verify redirects and mixed-content behavior rather than treating a single successful TLS handshake as complete website acceptance.\nOfficial reference\nCloudflare — Full (strict) – SSL/TLS encryption modes. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:17:02+00:00", "dateModified": "2026-10-20T18:34:37+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/prepare-the-origin-certificate-before-switching-cloudflare-to-full-strict/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/prepare-the-origin-certificate-before-switching-cloudflare-to-full-strict/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Prepare the origin certificate before switching Cloudflare to Full strict" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 268, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Cloudflare — Full (strict) - SSL/TLS encryption modes", "url": "https://developers.cloudflare.com/ssl/origin-configuration/ssl-modes/full-strict/" } } ] } }