Separate the two TLS connections

A proxied HTTPS request normally uses two TLS connections, not one. The browser negotiates TLS with Cloudflare’s edge and verifies Cloudflare’s certificate. Cloudflare then opens a second connection to your origin and verifies it separately, according to the configured SSL/TLS mode.

The padlock in the browser only proves the first leg. It says nothing about how Cloudflare talked to your origin.

Inspect the edge leg

Look at the certificate the browser actually sees:

openssl s_client -connect flaviocopes.com:443 -servername flaviocopes.com 2>/dev/null | openssl x509 -noout -subject -issuer
# subject=CN=flaviocopes.com
# issuer=C=US, O=Google Trust Services, CN=WE1

That certificate belongs to the Cloudflare edge. Your origin’s certificate never reaches the visitor. Cloudflare issues and renews the edge certificate for you.

The mode controls the origin leg

The SSL/TLS mode in the dashboard decides what happens on the second connection:

Off            no HTTPS at all — do not use
Flexible       browser leg HTTPS, origin leg plain HTTP
Full           origin leg HTTPS, certificate not validated
Full (strict)  origin leg HTTPS, certificate validated

Use Full (strict) with a valid certificate on the origin. Cloudflare can issue a free Origin CA certificate for exactly this: it is trusted by Cloudflare’s proxy, so the origin leg gets real verification without buying anything.

Full without strict encrypts the connection but accepts any certificate, including an expired or self-signed one presented by an attacker on the path.

The Flexible trap

Flexible mode leaves the origin leg on plain HTTP. Visitors see HTTPS, but traffic between Cloudflare and your server crosses the internet unencrypted.

It also creates a famous failure. Your origin redirects HTTP to HTTPS, Cloudflare keeps requesting HTTP because of Flexible mode, and the browser loops:

ERR_TOO_MANY_REDIRECTS

If you see an endless redirect on a freshly proxied site, check the SSL/TLS mode before touching your application code. Switching to Full (strict) with a proper origin certificate removes the loop and the plaintext leg at the same time.

Now inspect the edge certificate of a proxied site with the openssl command above, then document which certificate protects the origin connection and which mode your practice zone uses.