Cloudflare DNS + SSL Setup Done Right: Avoid the "Too Many Redirects" Infinite Loop

You change your nameservers to Cloudflare to speed up your website and get free CDN caching. You turn on the little orange cloud proxy icon, enable "Always Use HTTPS", refresh your browser, and boom:

ERR_TOO_MANY_REDIRECTS — The page isn't redirecting properly.

You clear your cache, panic-toggle settings in your hosting cPanel, break your .htaccess file, and end up disabling Cloudflare altogether.

No gol-mol: this is the most common DNS onboarding mistake in web development. Here is the architectural reason behind the infinite loop and the 2-minute fix.

1. Why the Infinite Loop Happens: The "Flexible SSL" Trap

When a visitor types your domain name, there are two distinct network legs involved:

• Leg 1 (Client to Cloudflare): The browser talks to Cloudflare's edge proxy server.
• Leg 2 (Cloudflare to Origin): Cloudflare's edge proxy fetches data from your real hosting server (Nginx/Apache).

2. The 3-Step Production Setup

Step 1: Switch Cloudflare SSL to "Full (Strict)"

Navigate to SSL/TLS → Overview in Cloudflare and set the encryption mode to Full (Strict). This forces Cloudflare to communicate with your origin server exclusively over secure HTTPS (Port 443) using a valid SSL certificate.

Step 2: Install a Cloudflare Origin CA Certificate

Instead of relying on Let's Encrypt renewal crons that randomly fail, generate a free 15-year Cloudflare Origin Certificate inside Cloudflare Dashboard (SSL/TLS → Origin Server) and install it directly on your Nginx or Apache host.

# Nginx Origin Server VirtualHost Configuration
server {
    listen 443 ssl http2;
    server_name yourdomain.com www.yourdomain.com;

    # Cloudflare Origin CA Certificates
    ssl_certificate /etc/ssl/certs/cloudflare_origin.pem;
    ssl_certificate_key /etc/ssl/private/cloudflare_origin.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    
    root /var/www/yourdomain/public;
    index index.php index.html;
}

Step 3: Enable Authenticated Origin Pulls

Once your Origin Certificate is running, enable "Authenticated Origin Pulls". This ensures your origin server will only accept web traffic coming directly from Cloudflare's IP range, preventing hackers from bypassing your firewall by hitting your raw server IP directly.

"Flexible SSL is not real security; it is an illusion that encrypts half the wire while leaving your backend origin naked to packet sniffers."