# Cloudflare free SSL vs a paid certificate: what you need > Cloudflare Universal SSL is free and covers most sites. When a paid OV or EV certificate still helps, which SSL mode to pick, and what Origin CA is. Source: https://ssl.sh/compare/cloudflare-ssl-vs-paid-certificate/ Last updated: 2026-11-10 Proxied through Cloudflare, most sites **do not need a paid SSL certificate**: Universal SSL gives every active domain a free, publicly trusted DV certificate, and a free Origin CA certificate covers the leg to your server. Pay only for OV or EV at the edge (Business or Enterprise plan), for unproxied hostnames, or when a contract requires a commercial CA. Facts about Cloudflare come from its documentation as of November 2026. Paid certificate prices were checked on the sellers' own pages on 10 November 2026; the seller's checkout page is authoritative. ## Two connections, two certificates A proxied request has two TLS legs: visitor to Cloudflare, and Cloudflare to your origin server. Each has its own certificate. | Leg | Who presents the certificate | Free option | Paid option | |---|---|---|---| | Visitor → Cloudflare | Cloudflare's edge | Universal SSL (all plans) | Advanced Certificate Manager add-on, or your own uploaded certificate (Business/Enterprise) | | Cloudflare → origin | Your server | Cloudflare Origin CA or any ACME certificate | Any certificate from a public CA | Browsers only ever see the edge certificate. A $76.99 EV certificate installed on your origin is invisible to visitors while the hostname is proxied. ## What Universal SSL gives you for free According to Cloudflare's documentation, Universal SSL issues and renews free, publicly trusted certificates for domains that are active on Cloudflare, on the Free, Pro, Business and Enterprise plans. The certificates are DV, last 90 days and are renewed automatically. On a full DNS setup they cover the apex domain and first-level subdomains; deeper names such as `a.b.example.com` need Total TLS or the paid Advanced Certificate Manager add-on. Cloudflare chooses the issuing CA from Let's Encrypt, Google Trust Services and SSL.com. Compared with a paid DV certificate, Universal SSL lacks nothing visitors can see. It is the same padlock, and renewal is fully automatic. ## Choose the right encryption mode Use Full (strict). Cloudflare's SSL/TLS encryption modes control the Cloudflare-to-origin leg: - **Off:** no HTTPS at all. - **Flexible:** HTTPS from visitors to Cloudflare, but plain HTTP from Cloudflare to your origin. Cloudflare recommends upgrading the origin whenever possible. - **Full:** HTTPS to the origin, but the origin certificate is not validated. - **Full (strict):** HTTPS to the origin with certificate validation; the certificate can come from a public CA or Cloudflare Origin CA. - **Strict (SSL-Only Origin Pull):** Cloudflare always connects to the origin over validated HTTPS, even for HTTP visitors. There is also an automatic mode that picks the most secure setting your origin supports. Cloudflare strongly recommends Full or Full (strict). Unlike Full, Full (strict) validates the origin certificate, so an attacker sitting between Cloudflare and your server cannot present a certificate of their own. Flexible is the weakest choice for any site with logins or forms, because passwords and form data cross the internet unencrypted on the second leg. ## Cloudflare Origin CA vs a public certificate on the origin Both free options work for Full (strict); a public ACME certificate also keeps the site working if you bypass Cloudflare. The two choices: - **Cloudflare Origin CA:** free on all plans, up to 200 names per certificate, apex and first-level wildcard included by default, and a validity you choose; Cloudflare's announcement gave a range from 7 days to 15 years. Only Cloudflare trusts it. If you pause Cloudflare or switch a hostname to DNS-only, visitors get certificate errors. Cloudflare also does not send expiry notifications. See [how to install a Cloudflare Origin certificate](https://ssl.sh/guides/cloudflare-origin-certificate/). - **A public ACME certificate** (Let's Encrypt or similar): trusted by browsers too, so the site keeps working if you bypass Cloudflare. It must be renewed well before it expires, which certbot or acme.sh can automate, including wildcards through the [Cloudflare DNS API](https://ssl.sh/guides/certbot-dns-cloudflare-wildcard/). A paid public certificate on the origin adds nothing to either option unless the origin must also be reached directly by clients that expect a commercial CA. ## When a paid certificate still makes sense Three cases still justify a paid certificate behind Cloudflare: 1. **You need OV or EV identity visible to visitors.** Cloudflare-managed certificates are DV. Custom certificates are meant for Business and Enterprise customers who want to use their own certificates, and Cloudflare's documentation names OV and EV needs as a reason. Free and Pro plans cannot upload them. The cheapest OV we verified was [Sectigo InstantSSL](https://ssl.sh/certificates/instantssl/) at GoGetSSL for $32.80, and the cheapest EV [Namecheap EV SSL](https://ssl.sh/certificates/namecheap-ev-ssl/) at $76.99. You must upload and renew uploaded certificates yourself. 2. **Some hostnames are DNS-only.** Hostnames you leave unproxied, such as a mail server, connect clients straight to your server, so they see your own certificate. A free ACME certificate works; a paid one is needed only if the service cannot automate renewal. 3. **A contract or auditor requires a specific commercial CA** for the edge certificate. Remember the validity limits for any uploaded certificate: since 15 March 2026 a publicly trusted TLS certificate lasts at most 200 days, falling to 100 days on 15 March 2027 and 47 days on 15 March 2029. A paid "multi-year" plan therefore means re-uploading a new certificate to Cloudflare several times. Read [multi-year SSL after the 200-day limit](https://ssl.sh/compare/multi-year-ssl-after-200-days/). ## Quick decision Most Cloudflare sites pay nothing for certificates: - **Personal site, blog or small business on Cloudflare:** Universal SSL plus Origin CA or Let's Encrypt on the origin, mode Full (strict). Cost: nothing. - **Shop or SaaS on Cloudflare without an OV/EV requirement:** the same. - **OV/EV required at the edge:** Business or Enterprise plan plus an uploaded certificate, or keep the hostname off Cloudflare's proxy. - **Not using Cloudflare's proxy at all:** Cloudflare's certificates do not apply; see [free vs paid SSL](https://ssl.sh/compare/free-vs-paid-ssl/).