Tagged: SSL
- This topic has 3 replies, 3 voices, and was last updated 3 years, 1 month ago by
Hugh.
-
AuthorPosts
-
August 2, 2021 at 10:54 am #16822
PaulOyler
ParticipantI've received several of these emails from CloudFlare over the past couple of days:
Your SSL/TLS Setting Recommendation
Thanks for enabling SSL/TLS Recommender in the dashboard. You’re receiving this email because our security service observed the SSL/TLS mode for xxxxxxxxxx.xxx is Full but would benefit from the additional security provided by Strict.
They have all been for the only non-WP sites that I host (just HTML sites).
Is there a reason that these HTML sites would benefit from this additional security?
If so, why, and is it really a better option?
These also happen to be my busiest sites, with several thousand visitors weekly. (It's a local motorsports racing organization with a site for each of their various divisions. Each site has latest results, points standings, upcoming events, weather cancellations, etc.)August 2, 2021 at 11:24 am #16823Benjamin
KeymasterI'm pretty sure this is simply an "upsell" attempt. The term "FULL" over within Cloudflare's SSL modes doesn't mean 'beyond capacity', but an identifying method of the different modes (Flexible / Full / Strict / Off). And each of those dictates how Cloudflare treats incoming URL requests (ie turning HTTP into HTTPS or rejecting anything not HTTPS or a variation.
The push to go "Strict" is a way for them to sell you a standalone SSL certificate.
Now... its also possible (small chance) that your previous SSL certificate has expired and the "Full" SSL Mode actually doesn't verify if the used certificate is valid or expired.
August 2, 2021 at 11:40 am #16824PaulOyler
ParticipantI'm using security certificate through Server Pilot.
August 3, 2021 at 2:04 pm #16830Hugh
ParticipantOptions:
1) Off: No encryption applied
2) Flexible: Encrypts traffic between the browser and Cloudflare
3) Full: Encrypts end-to-end, using a self signed certificate on the server
4) Full (strict): Encrypts end-to-end, but requires a trusted CA or Cloudflare Origin CA certificate on the serverFull vs Strict has to do with what type of certificate you have on your server. If it's not self signed, and an actual CA issued certificate, then you can use strict. Either way, the important thing is to have an actual CA certificate on your site (i.e. via Let's Encrypt), which it sounds like you do. After that, shouldn't really matter Full or Strict at Cloudflare.
If it is an upsell attempt, I've never seen it as being in your face about it.
-
AuthorPosts
- You must be logged in to reply to this topic.