3 ms·

Yeah, the free version is HTTPS only between client and CF. I made my blog hosted on Github HTTPS with this, mainly so that I can experiment some features like

Yeah, the free version is HTTPS only between client and CF. I made my blog hosted on Github HTTPS with this, mainly so that I can experiment some features like Service Workers.

adrianmacneil 11y ago
Source? Last time I used it you could encrypt both hops (although you obviously need to tell CF to ignore the cert mismatch for backend server).
- gkop 11y ago
  Yes, I use free CF with both hops encrypted. There's no way for my visitors to know this though. IMO CF should require both hops be encrypted.
- kevincox 11y ago
  They are both encrypted but since you can't verify the "server" certificate it is vulnerable to MITM.