Skip to content

Updates to Automatic SSL/TLS #22061

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Apr 30, 2025
Merged

Updates to Automatic SSL/TLS #22061

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e8caa07
Updates to Automatic SSL/TLS
angelampcosta Apr 29, 2025
e321df0
Apply suggestions from code review
angelampcosta Apr 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 9 additions & 6 deletions src/content/docs/ssl/origin-configuration/ssl-modes/index.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,13 +37,16 @@ Automatic SSL/TLS leverages advanced methods developed by the SSL/TLS Recommende
Automatic SSL/TLS will not change your setting to a less secure encryption mode. For example, if your origin certificate expires, the encryption mode will not change from **Full (strict)** to **Full**. You must ensure the validity of your origin SSL/TLS configuration at all times.
:::

Cloudflare is enabling Automatic SSL/TLS on the following dates:
#### Additional details

| Plan | Using SSL/TLS recommender? | Grace period ends |
| -------------- | -------------------------- | ----------------- |
| Non-Enterprise | Yes | November 5th, 2024 |
| Enterprise | Yes | February, 2025 |
| All plans | No | March, 2025 |
- **Scan frequency**: Recommender scans currently occur approximately once per month, though they may happen more frequently in some cases (for example, configuration changes or upgrades). Scans stop when:

- The site is already using the most secure mode (for example, **Full (strict)**), or
- You switch from auto mode to **Custom SSL/TLS**.

- **Error checking before upgrades**: To prevent disruptions, Cloudflare checks for `5XX` errors (like `502` or `503`) and evaluates whether the HTTP and HTTPS content is consistent before upgrading a zone's encryption mode.

- **Upgrade notifications**: Cloudflare sends weekly digest emails listing which zones have been upgraded by the Recommender. These emails are currently sent to Super Admins only.

#### Opt out single zone

Expand Down