Cloudflare redirect loop after an origin certificate

A site behind Cloudflare works for months. Then someone installs a proper certificate on the origin server, forces HTTPS there like every guide says, and the site turns into ERR_TOO_MANY_REDIRECTS for every visitor. We hit this on bangkok.biz. It takes a minute to fix and an hour to understand if you have never seen it, so here is the minute.

What is happening

Cloudflare's SSL mode "Flexible" means: the visitor talks to Cloudflare over HTTPS, and Cloudflare talks to your origin over plain HTTP. Your origin sees an HTTP request. If the origin is configured to redirect HTTP to HTTPS, it answers with a redirect to https://…. Cloudflare passes that to the visitor, the visitor requests the HTTPS URL again, Cloudflare fetches it from the origin over HTTP again, and the origin redirects again. Forever.

Nothing is broken. Two correct rules are fighting.

The fix

Once the origin has a real certificate (Let's Encrypt or a Cloudflare Origin CA certificate), set the Cloudflare SSL mode to Full (strict). Cloudflare now talks HTTPS to the origin, the origin sees an HTTPS request, no redirect happens, and the loop ends. "Full" without "strict" also stops the loop but does not verify the origin certificate, so use strict.

The order matters:

1. Install the certificate on the origin and confirm it serves the site on port 443 directly (curl -sI --resolve yourdomain:443:ORIGIN_IP https://yourdomain/).
2. Switch Cloudflare to Full (strict).
3. Only then force HTTPS on the origin, if it is not already.

Doing step 3 before step 2 produces the loop.

Two related surprises

• The old tab still says "Not secure". A browser tab opened before the certificate was installed keeps showing the old state until it is reloaded. It is not the server.
• Chromium shows a same-URL 307 in DevTools. After a site starts sending client hints headers, Chrome may issue an internal 307 to itself to retry with the hints. It looks like a server redirect and is not one.

Check after switching

Run the same curl through Cloudflare and directly against the origin; both should answer 200 with no Location header. Then load the site in a private window. If you use a "Bunny" or other CDN in front instead of Cloudflare, the same logic applies: the CDN-to-origin connection (HTTP or HTTPS) has to match what the origin expects.