Back to Checks
cloudflare

SSL/TLS encryption mode is set to Full (Strict)

zone_ssl_strict
Service: zoneSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:Zone

Cloudflare zones are assessed for SSL/TLS encryption mode by checking if the mode is set to Full (Strict) to ensure end-to-end encryption with certificate validation.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Without strict SSL mode, traffic between Cloudflare and origin may use unvalidated or unencrypted connections. Sensitive data can be intercepted via man-in-the-middle attacks, responses can be modified without detection, and this may violate PCI-DSS, HIPAA, and other regulatory requirements.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_ssl_strict

Recommendation

Configure SSL/TLS mode to Full (Strict) and install a valid certificate on your origin server.

  • Use Cloudflare Origin CA certificates for seamless integration
  • Ensure origin server presents a valid certificate matching your domain
  • Enable Authenticated Origin Pulls for additional security

Remediation

Terraform

# Set SSL/TLS mode to Full (Strict) for end-to-end encryption
resource "cloudflare_zone_setting" "ssl" {
  zone_id    = "<ZONE_ID>"
  setting_id = "ssl"
  value      = "strict" # Critical: ensures certificate validation between Cloudflare and origin
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to SSL/TLS > Overview
3Under SSL/TLS encryption mode, select Full (strict)
4Ensure your origin server has a valid SSL certificate installed (Cloudflare Origin CA or publicly trusted CA)

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client


class zone_ssl_strict(Check):
    """Ensure that SSL/TLS encryption mode is set to Full (Strict) for Cloudflare zones.

    The SSL/TLS encryption mode determines how Cloudflare connects to the origin
    server. In 'strict' mode, Cloudflare validates the origin
    server's SSL certificate, ensuring end-to-end encryption with certificate
    verification. Lower modes (off, flexible, full) are vulnerable to
    man-in-the-middle attacks between Cloudflare and the origin.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the SSL strict mode check.

        Iterates through all Cloudflare zones and verifies that the SSL/TLS
        encryption mode is set to 'strict'. This mode
        requires a valid SSL certificate on the origin server and provides
        full end-to-end encryption with certificate validation.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if
            SSL mode is 'strict', or FAIL status if using
            less secure modes like 'off', 'flexible', or 'full'.
        """
        findings = []
        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )
            ssl_mode = (zone.settings.ssl_encryption_mode or "").lower()
            if ssl_mode == "strict":
                report.status = "PASS"
                report.status_extended = f"SSL/TLS encryption mode is set to Full (Strict) for zone {zone.name}."
            else:
                report.status = "FAIL"
                report.status_extended = f"SSL/TLS encryption mode is set to {ssl_mode.capitalize()} for zone {zone.name}, which is not Full (Strict)."
            findings.append(report)
        return findings

References