Check ID: zone_ssl_strict
Provider: Cloudflare
Service: zone
Severity: HIGH
Categories: encryption
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for SSL/TLS encryption mode by checking if the mode is set to Full (Strict) to ensure end-to-end encryption with certificate validation.

​
Risk

Without strict SSL mode, traffic between Cloudflare and origin may use unvalidated or unencrypted connections. Sensitive data can be intercepted via man-in-the-middle attacks, responses can be modified without detection, and this may violate PCI-DSS, HIPAA, and other regulatory requirements.

​
Recommendation

Configure SSL/TLS mode to Full (Strict) and install a valid certificate on your origin server.
  • Use Cloudflare Origin CA certificates for seamless integration
  • Ensure origin server presents a valid certificate matching your domain
  • Enable Authenticated Origin Pulls for additional security

​
Remediation

# Set SSL/TLS mode to Full (Strict) for end-to-end encryption
resource "cloudflare_zone_setting" "ssl" {
  zone_id    = "<ZONE_ID>"
  setting_id = "ssl"
  value      = "strict" # Critical: ensures certificate validation between Cloudflare and origin
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_ssl_strict. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks