Under most configurations, Cloudflare does have the private key. They act as an HTTP proxy, not a TLS proxy. Cloudflare does support a "keyless SSL" mode [1] f

Under most configurations, Cloudflare does have the private key. They act as an HTTP proxy, not a TLS proxy. Cloudflare does support a "keyless SSL" mode [1] for enterprise customers, but this only applies to the certificate private key -- the session key for each TLS session is still under Cloudflare's control, so they still have access to the contents of the HTTPS session. [1]: https://www.cloudflare.com/ssl/keyless-ssl/ https://www.cloudflare.com/ssl/keyless-ssl/