> Also the connection between you and them is not encrypted While you are right in that cloudflare won't stop you making this questionable design choice if you

> Also the connection between you and them is not encrypted While you are right in that cloudflare won't stop you making this questionable design choice if you want, you shouldn't and you don't have to either. You can still use cloudflare's ssl certificate AND use letsencrypt/<other cert provider> to secure traffic between cloudflare and your server, ensuring SSL end to end (aside from the obvious MITM stuff cloudflare have to do in order to successfully retrieve content from their caches etc). Cloudflare call this configuration "full" encryption, as opposed to the somewhat terribly named "dynamic" setup you are referring to. This is one aspect of cloudflare I'm not huge on either, given that when users see an SSL padlock they may have a reasonable expectation their input is at least encrypted until it reaches the destination server (again with the cache MITM caveats and so on) but no one is forcing you to use it that way.