SSL Certificates Explained: Let's Encrypt, Origin CA, Full Strict

Every website needs HTTPS. Browsers warn visitors about sites without it, forms and logins depend on it, and search engines favour it. Getting a certificate is now free and mostly automatic, but the choices around it can still be confusing, especially once Cloudflare is involved. This guide explains what an SSL certificate does, the two kinds of free certificate you are most likely to meet, and how Cloudflare's SSL modes fit together.

What an SSL certificate does

An SSL certificate (strictly speaking, a TLS certificate) does two jobs:

1. Encryption. It lets the browser and server agree on keys to encrypt everything sent between them, so nobody on the network can read passwords, form data or payment details.
2. Identity. It proves the server is allowed to serve your domain. A trusted certificate authority (CA) issued it after checking that whoever requested it controls the domain.

When both work, the browser shows the site as secure. When the certificate is missing, expired, or issued for a different name, the browser shows a warning that drives most visitors away.

Types of certificates

• Domain validated (DV): proves control of the domain. This is what free certificates are, and it is all most websites need.
• Organisation validated (OV) and extended validation (EV): also check the organisation behind the domain. Browsers no longer display this prominently, so the practical benefit for most sites is small.
• Wildcard: covers all subdomains of a domain, such as *.example.com.

Let's Encrypt: free, trusted, automatic

Let's Encrypt is a non-profit certificate authority that issues free DV certificates trusted by all major browsers. Certificates are valid for a few months at most and are designed to be renewed automatically by the server software.

To issue a certificate, Let's Encrypt checks that you control the domain, usually by requesting a special file over HTTP from the domain. That means the domain must already point to the server issuing the certificate.

Use Let's Encrypt when:

• Visitors connect directly to your server, without Cloudflare.
• You use your own Cloudflare account and want a certificate on the server that any client will trust.

Cloudflare Origin CA: for the connection behind Cloudflare

When your site runs through Cloudflare's proxy, there are two connections: visitor to Cloudflare, and Cloudflare to your server (the origin). Cloudflare handles the first one with its own certificate. For the second, Cloudflare offers Origin CA certificates.

An Origin CA certificate is free and can be valid for many years, so renewals are rarely a concern. The catch: it is trusted only by Cloudflare, not by browsers. If someone bypasses Cloudflare and connects to the server directly, or if you turn off Cloudflare's proxy for the domain, browsers will show a warning. It is the right choice only when the domain is permanently behind Cloudflare.

Cloudflare SSL modes

Cloudflare lets you choose how it connects to your server:

Off

No HTTPS at all. Not acceptable for a public site.

Flexible

Visitors connect to Cloudflare over HTTPS, but Cloudflare connects to your server over plain HTTP. The browser shows a padlock even though half the journey is unencrypted. It also causes redirect loops when the server itself redirects HTTP to HTTPS. Avoid it.

Full

Cloudflare connects to the server over HTTPS, but accepts any certificate, even an expired or self-signed one. The traffic is encrypted, but Cloudflare does not check who it is talking to. It is useful as a temporary setting while you issue a proper certificate.

Full (strict)

Cloudflare connects over HTTPS and checks that the server's certificate is valid and matches your domain. Either a Let's Encrypt certificate or an Origin CA certificate satisfies this. This is the mode you want.

Which combination should you use?

• No Cloudflare: Let's Encrypt on the server.
• Your host manages Cloudflare for you: Origin CA on the server with Full (strict) is a clean, long-lived setup.
• Your own Cloudflare account: Let's Encrypt on the server with Full (strict). Use Full only until the certificate is issued.

How to check a certificate yourself

You do not need special tools to see what certificate a site is using. In most browsers, click the padlock or site information icon next to the address, then open the certificate details. Check three things:

• Issued to: the domain names the certificate covers. Both the bare domain and www should be listed, or covered by a wildcard.
• Issued by: the certificate authority. Behind Cloudflare's proxy you will see the certificate Cloudflare shows visitors, not the one on your server.
• Valid until: the expiry date. With automatic renewal, it should always be some weeks away.

If a certificate is close to expiry and has not renewed, the usual cause is that the domain no longer points to the server that issued it.

Common SSL problems and fixes

• "Too many redirects": almost always Cloudflare set to Flexible while the site forces HTTPS. Switch to Full (strict) once the server has a certificate.
• Mixed content warnings: the page loads images or scripts over http://. Update those links to https://, or use your CMS's search and replace.
• Certificate cannot be issued: check that the domain and www point to the right server and that DNS changes have spread.
• Warning after leaving Cloudflare: an Origin CA certificate is still on the server. Issue a Let's Encrypt certificate instead.

For step-by-step help, see our article on SSL certificates in Plesk.

Free SSL on every Zebra plan

Every Zebra hosting plan includes free SSL, set up for you:

• With Zebra's Cloudflare, we install an Origin CA certificate on the server and run the domain in Full (strict) mode.
• With your own DNS or Cloudflare, you issue a free Let's Encrypt certificate from the client area once your records point to us.

See shared hosting from €2.99 a month or WordPress hosting from €3.99 a month, both billed yearly, with Plesk and Cloudflare included and setup in about two minutes.