Cloudflare SSL/TLS Encryption Modes & Origin Timeout Troubleshooting

Overview

This document details the operational differences between Cloudflare's SSL/TLS encryption modes (Flexible, Full, Full (Strict)) and analyzes a common origin timeout failure mode caused by mismatching edge-to-origin encryption settings with origin firewall port forwarding rules.

1. Cloudflare SSL/TLS Encryption Modes

Cloudflare operates as a reverse proxy. Web traffic is split into two distinct legs:
1. Client <-> Cloudflare (Edge Connection)
2. Cloudflare <-> Origin Server (Origin Connection)

[ Client Browser ] <--- (Edge TLS) ---> [ Cloudflare Edge Proxy ] <--- (Origin TLS) ---> [ Origin Firewall / HAProxy ]

Encryption Modes Comparison Table

Flexible Mode

• Edge Connection: Ssl-encrypted HTTPS (Port 443).
• Origin Connection: Unencrypted HTTP over Port 80.
• Use Case: Legacy origin servers without an SSL/TLS certificate installed.
• Security Risk: Traffic between Cloudflare and the origin server travels in cleartext over the public Internet, making it vulnerable to interception and Man-in-the-Middle (MitM) attacks.
• Critical Requirement: The origin gateway/router MUST accept and forward incoming HTTP requests on Port 80.

Full Mode

• Edge Connection: SSL-encrypted HTTPS (Port 443).
• Origin Connection: SSL-encrypted HTTPS over Port 443.
• Use Case: Origin servers with an SSL/TLS certificate installed (supports self-signed, expired, or local untrusted CA certificates).
• Validation: Cloudflare connects via HTTPS but does not validate whether the certificate is signed by a trusted public CA or matches the hostname.

Full (Strict) Mode

• Edge Connection: SSL-encrypted HTTPS (Port 443).
• Origin Connection: SSL-encrypted HTTPS over Port 443 with strict certificate verification.
• Use Case: Production environments requiring strict end-to-end security.
• Validation: Cloudflare requires a valid SSL/TLS certificate on the origin server issued by a trusted public Certificate Authority (e.g., Let's Encrypt) or a Cloudflare Origin CA. Expired or hostname-mismatched certificates trigger a Cloudflare Error 526 (Invalid SSL Certificate).

2. Case Study: Origin Connection Timeout (Error 522 / Timeout)

System Architecture & Configuration

• Domain: home.example.com (Cloudflare Proxy Enabled / Orange Cloud).
• Perimeter Firewall / Edge Router: Configured to forward only Port 443 (HTTPS) traffic to an internal reverse proxy Virtual IP (10.0.0.100). Port 80 (HTTP) is blocked at the ISP or router level.
• Reverse Proxy: HAProxy configured with an HTTPS frontend bound exclusively to port 443 (bind *:443 ssl crt /etc/haproxy/certs/).

Root Cause Analysis of Failure

1. Client Request: A client requests https://home.example.com.
2. Edge Ingestion: Cloudflare terminates the client TLS connection on port 443.
3. Misconfiguration: Cloudflare's SSL/TLS mode is set to Flexible.
4. Origin Connection Attempt:
5. Because of Flexible mode, Cloudflare initiates an unencrypted origin connection to http://<ORIGIN_PUBLIC_IP>:80.
6. Firewall Drop:
7. The perimeter router / ISP firewall drops all incoming TCP SYN packets on Port 80 because only Port 443 is open/forwarded.
8. No TCP SYN-ACK response is returned to Cloudflare.
9. Timeout Error: Cloudflare waits ~15 seconds for a response before terminating the connection and serving an Error 522 (Connection timed out) page to the client.

[ Client ] --(HTTPS :443)--> [ Cloudflare ] --(HTTP :80)--> [ Edge Router (Only 443 Open) ]
                                                                       |
                                                                  [ DROPPED ] (Port 80 closed)
                                                                       |
                                                           Cloudflare Error 522

3. Resolution

1. Reconfigure Cloudflare SSL/TLS Mode:
   • Navigate to Cloudflare Dashboard $\rightarrow$ SSL/TLS $\rightarrow$ Overview.
   • Change the encryption mode from Flexible to Full or Full (Strict).
2. Verification:
   • Cloudflare routes subsequent origin requests directly over Port 443 (HTTPS).
   • Traffic successfully passes through the perimeter router's Port 443 forward rule to HAProxy (10.0.0.100:443), resolving the timeout issue.