@Ken Let’s Encrypt does take a bit of knowledge to get it running. But if you’ll not be going into any sensitive data through the use of the CloudFlare CDN, then you may opt for the CloudFlare route.

But if you’ve got Let’s Encrypt through your hosting provider — by all means opt for that! I’d love to have a PCI-compliant TLS certificate any time of the day!

Kind regards,

Mic Sumner

Thank you for the reply Khek.

Good to know that Let’s Encrypt is now the more obvious choice!

Hope any CloudFlare staff might respond to this?

Kind regards,

Mic Sumner

Remember Cloudbleed?

The bug was serious because the leaked memory could contain private information and because it had been cached by search engines. We have also not discovered any evidence of malicious exploits of the bug or other reports of its existence.
https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/

In other words, nobody will ever know how bad it really was, and some information (“full https requests, client IP addresses, full responses, cookies, passwords, keys, data, everything”) might still be publicly queryable.

Let’s Encrypt provides end-to-end encryption whereas Cloudflare doesn’t. So for my money (they’re both free!) it’s a more secure solution regardless of whether or not you’re sending data to your server. Hope this helps some folks decide!

I disagree, IE and Edge work absolutely fine with out any warnings for sites I’ve set up with Cloudflare free SSL

A lot of hosting providers let you install it just by clicking on one button. Here is an up-to-date list of these companies https://community.letsencrypt.org/t/web-hosting-who-support-lets-encrypt/6920

I didn’t get that implication, just that it was the ‘easier’ route rather than the only free route. Let’s Encrypt is wonderful, but some technical knowledge is required to get it running.

I agree, some hosting providers don’t have a free SSL like Let’s Encrypt, so we’ll have to opt for a CDN’s reverse proxy to account for this if the client wishes to stay on their hosting for their reasons.

But I’m pretty sure hosting providers will provide Let’s Encrypt SSL since come-on it’s everywhere and it’s great!

One Question:
Why do we choose ‘Full’, as this does not seem to work! Instead, we will have to set this to Flexible SSL please. Please review this here at CloudFlare’s SSL options.

Love Cloudflare since the website would then be able to make use of HTTP/2 protocol among other CloudFlare server enhancements — which a great thing if your current hosting provider doesn’t have these enhancements!

Kind regards,

Mic Sumner

There are definitely hosting providers that make it a 1-click process by utilizing Let’s Encrypt. I know Siteground generates certificates automatically whenever you add a new domain to your hosting account, you don’t even have to do it yourself. I’m guessing other hosting providers have started doing that as well.

Our site is hosted remotely but with one important part of our site is using iframes to display content that is on a server here in our office. It’s my understanding that if I were to enable the https on the main site the iframes would no longer work, since the server here does not have SSL set up.

Is SSL domain based or server based?

Do I need to get SSL setup on both servers for all to function properly?

Thanks