Prepare the origin certificate before switching Cloudflare to Full strict

The edge-to-origin connection must meet validity, issuer, and hostname requirements.

Source facts

Cloudflare states that Full (strict) validates the origin certificate rather than merely encrypting that connection. The certificate must be within its validity period, issued by a publicly trusted CA or Cloudflare Origin CA, and match the requested or target hostname. The origin must accept HTTPS on the required port; failing the prerequisites can produce a 526 error.

Source: Cloudflare — Full (strict) – SSL/TLS encryption modes.

Applicability

This concerns Cloudflare’s website origin TLS mode.

DSE recommendation

DSE recommends inventorying every origin and hostname affected by the mode before changing it. Install and validate the origin certificate and chain first, including renewal ownership and required network access. Check the actual target hostname used by origin routing rather than assuming it always equals the public name. Keep a tested rollback that preserves an appropriate security posture instead of leaving validation disabled as a permanent workaround. Have each origin owner approve the hostname used for the TLS validation check, including any configured target override. Keep the intended issuer and renewal contact beside that name. Require the origin prerequisites to pass before the edge setting changes rather than troubleshooting certificate eligibility after production traffic fails.

Verification

For each approved origin, inspect certificate name, validity, chain, and listener before enabling the mode. Then request representative public paths through Cloudflare with normal browser validation. Confirm the origin connection succeeds, review any 526 evidence, and separately verify redirects and mixed-content behavior rather than treating a single successful TLS handshake as complete website acceptance.

Official reference

Cloudflare — Full (strict) – SSL/TLS encryption modes. Reviewed October 20, 2026.