Getting a free SSL certificate with Cloudflare

Every public website should use HTTPS. It encrypts traffic between the browser and the server, prevents casual monitoring and tampering, and avoids the browser warnings shown for insecure pages.

The technology is now TLS, although people still commonly say SSL certificate. Cloudflare’s Universal SSL gives sites behind its network a free certificate, which makes it a practical option for a small site.

Setting it up

1. Create a Cloudflare account and add the site.
2. Choose the free plan. It is enough for most personal and small websites.
3. Cloudflare will give you two nameservers. Sign in to your domain registrar and replace the current nameservers with these values.
4. Open the SSL settings in Cloudflare and choose the appropriate encryption mode.
5. Wait for the certificate to become active, then confirm the site loads over https://.

The encryption mode matters. “Flexible” encrypts traffic only between the visitor and Cloudflare, leaving the connection from Cloudflare to your origin unencrypted. It can be useful when the origin cannot support HTTPS, but I would prefer “Full” or “Full (strict)” when the origin has a certificate. That protects the complete journey rather than only its first half.

After HTTPS works, redirect HTTP requests to HTTPS and check for mixed content such as images or scripts still loaded over http://. The padlock is useful confirmation, but the real goal is an encrypted connection all the way through.