Overview
Enabling HTTPS has become a basic requirement for websites. When a website is connected to a cdn, the SSL/TLS certificate configuration method differs—the certificate can be installed on the origin server, on the CDN node, or on both ends.
This article introduces several SSL/TLS configuration modes in CDN scenarios and how to implement HTTPS acceleration with free certificates.
I. Three SSL Modes in CDN Scenarios
Mode 1: SSL termination at the CDN node
The user-to-CDN node connection uses HTTPS, while the CDN-to-origin connection uses HTTP. This is the most common configuration; the origin server does not need to install a certificate, and setup is simple. The disadvantage is that the CDN-to-origin segment is transmitted in plaintext.
Mode 2: End-to-end encryption (SSL direct connection)
The user-to-CDN connection uses HTTPS, and the CDN-to-origin connection also uses HTTPS (usually using the origin certificate or a self-signed certificate). The origin server needs to install a certificate, and configuration is slightly more complex, but the entire path is encrypted.
Mode 3: Custom certificate upload
Upload your own paid certificate to the CDN platform, and the CDN node directly provides the certificate. This is suitable for scenarios requiring branded certificates (such as EV certificates) or specific cipher suites.
II. Recommended Solution: Free Certificate + End-to-End Encryption
For most individual webmasters, it is recommended to use a Let's Encrypt free certificate + end-to-end encryption mode:
- Install a Let's Encrypt certificate on the origin server (use Certbot for automatic application)
- Upload the origin certificate in the CDN console, or use the free certificate provided by the CDN
- Use HTTPS for CDN back-to-origin (choose "Protocol Follow" or "Force HTTPS")
In this way, both the user-to-CDN and CDN-to-origin connections are encrypted, ensuring full security.
III. SSL Configuration Methods of Major CDNs
| CDN | Free Certificate | Custom Certificate | Back-to-Origin Method |
|---|---|---|---|
| Cloudflare (Free) | ✅ Automatically provided (Universal SSL) | ✅ | HTTP/HTTPS optional |
| Cloudflare (Pro+) | ✅ Custom upload supported | ✅ | End-to-end encryption |
| Upyun | ✅ (Let's Encrypt) | ✅ | HTTP/HTTPS optional |
| Qiniu Cloud | ✅ (Managed certificate) | ✅ | HTTP/HTTPS optional |
| Alibaba Cloud CDN | ✅ (Free certificate) | ✅ | HTTP/HTTPS optional |
| Tencent Cloud EdgeOne (Free) | ✅ (Automatically managed) | ❌ | HTTPS (default) |
IV. Detailed Explanation of Cloudflare SSL Modes
Cloudflare Free Plan provides four SSL modes, configured in the console under "SSL/TLS":
- Off (no encryption): Not recommended, deprecated.
- Flexible: User-to-CF encrypted, CF-to-origin HTTP. The origin server does not need a certificate, but the CF-to-origin connection is transmitted in plaintext.
- Full: User-to-CF encrypted, CF-to-origin HTTPS (the origin needs a certificate, but it can be self-signed).
- Full (strict): User-to-CF encrypted, CF-to-origin HTTPS (the origin certificate must be issued by a trusted CA, such as Let's Encrypt). Recommended.
It is recommended to enable Full (strict) mode, combined with a Let's Encrypt certificate on the origin server, to achieve end-to-end encryption.
V. Configuration Steps (Using Cloudflare + Let's Encrypt as an Example)
sudo apt install certbot Python3-certbot-nginx -y
sudo certbot --nginx -d example.com -d www.example.com
- Install Certbot on the origin server and apply for a Let's Encrypt certificate:
- In the Cloudflare console, set the SSL/TLS mode to "Full (strict)".
- Cloudflare will automatically use the origin certificate to verify the encrypted connection, with no additional upload required.
- Ensure HTTPS listening is working properly in the origin server's Nginx configuration.
Verification method: Visit the website, check the lock icon in the browser address bar, and confirm the certificate is valid. Also check the "Edge Certificates" status in the Cloudflare console.
VI. Frequently Asked Questions
Q: After using Cloudflare Free Plan, does the origin server still need a certificate?
If using Flexible mode, no. If using Full or Full (strict) mode, a certificate needs to be installed (Full mode can use a self-signed certificate; Full (strict) requires a certificate issued by a trusted CA).
Q: What is the difference between a CDN free certificate and a paid certificate?
Free certificates (such as Let's Encrypt) have a short validity period (90 days) and require automatic renewal. Paid certificates have a longer validity period (1–2 years) and higher brand trust, but free certificates are sufficient for personal websites.
Q: Will CDN speed slow down after enabling HTTPS?
The HTTPS handshake adds one round-trip delay (about 100–200ms), but CDN nodes usually support Session Resumption and TLS 1.3, which can greatly reduce latency. For most websites, the speed impact is negligible.
By properly configuring SSL modes, you can ensure security while fully utilizing the CDN's acceleration capabilities.
