[Cache] Update info about impact of SSL settings on Cache behavior (#17057)

* Update info about impact of SSL settings on Cache behavior

* Update src/content/docs/ssl/origin-configuration/ssl-modes/index.mdx

* Update src/content/docs/cache/how-to/cache-keys.mdx

Co-authored-by: marciocloudflare <[email protected]>

---------

Co-authored-by: marciocloudflare <[email protected]>

Author: 2 people

src/content/docs/cache/how-to/cache-keys.mdx

@@ -41,13 +41,21 @@ There are a couple of common reasons to change the Cache Key Template. You might
 * Fragment the cache so one URL is stored in multiple files. For example, to store different files based on a specific query string in the URL.
 * Consolidate the cache so different HTTP requests are stored in the same file. For example, to remove the Origin header added to Cloudflare Cache Keys by default.
 
-:::note[Note]
+### Impact of SSL settings on Cache behavior
 
+The `$scheme` refers to the protocol (HTTP or HTTPS) sent to your origin web server, not the protocol received from the visitor. Therefore, setting the Cloudflare [SSL option](/ssl/origin-configuration/ssl-modes/) influences caching decisions. For example, when using [Flexible SSL](/ssl/origin-configuration/ssl-modes/flexible/), Cloudflare only attempts to connect to your origin web server via HTTP. This means that Cloudflare serves the same cached resource for visitor requests via either HTTP or HTTPS, since Flexible SSL instructs Cloudflare to connect to an origin solely over HTTP.
 
-`$scheme` is the protocol (HTTP or HTTPS) sent to your origin web server and not the protocol received from the visitor. Therefore, setting the Cloudflare [SSL option](/ssl/origin-configuration/ssl-modes/) influences caching decisions. For instance, Cloudflare only attempts to connect to your origin web server via HTTP when [Flexible SSL](/ssl/origin-configuration/ssl-modes/flexible/) is utilized. Thus, Cloudflare serves the same cached resource for visitor requests via either HTTP or HTTPS since Flexible SSL instructs Cloudflare to connect to an origin solely over HTTP.
+It is important to understand how SSL setting changes affect the cache:
 
+- Switching from **Off** to **Full**, **Full (strict)**, or **Strict** will change the origin scheme from HTTP to HTTPS. This results in a cache bust, meaning the cached content becomes invalid and needs to be re-fetched from the origin server.
 
-:::
+- Transitioning from **Flexible** to **Full**, **Full (strict)**, or **Strict** changes the origin scheme from HTTP to HTTPS, causing a cache bust.
+
+- Downgrading from **Full**, **Full (strict)**, or **Strict** to **Flexible** or **Off** changes the origin scheme from HTTPS to HTTP, resulting in a cache bust.
+
+This behavior is important to consider when adjusting SSL settings, as any change in the origin scheme (HTTP to HTTPS or vice versa) triggers a cache reset.
+
+### Cache Level: Ignore Query String
 
 A [Cache Level](/cache/how-to/set-caching-levels/) of Ignore Query String creates a Cache Key that includes all the elements in the default cache key, except for the query string in the URI that is no longer included. For instance, a request for `http://example.com/file.jpg?something=123` and a request for `http://example.com/file.jpg?something=789` will have the same cache key, in this case.
 

src/content/docs/ssl/origin-configuration/ssl-modes/index.mdx

@@ -27,6 +27,8 @@ We are gradually rolling out the new [Automated SSL/TLS feature](#automatic-sslt
 If your zone has not been migrated yet, you will only have [Custom SSL/TLS](#custom-ssltls) options in your dashboard.
 :::
 
+To understand how the various encryption modes affect your cache, refer to the section on [Impact of SSL setting on cache behavior](/cache/how-to/cache-keys/#impact-of-ssl-settings-on-cache-behavior).
+
 ### Automatic SSL/TLS (default)
 
 Automatic SSL/TLS uses the [SSL/TLS Recommender](/ssl/origin-configuration/ssl-tls-recommender/) to identify and apply the most secure encryption mode for your website. It continuously assesses your traffic to determine if a more secure option is needed based on your origin certification or capabilities, and updates your settings automatically to ensure the highest level of security for your domain.