This is one of those problems that looks catastrophic but has a five-minute fix - once you know what you are looking at.
You set up Cloudflare in front of your site. Your origin server has a valid Let’s Encrypt certificate and forces HTTP to HTTPS. Everything should work. Instead, you get ERR_SSL_PROTOCOL_ERROR and an infinite redirect loop.
What Is Actually Happening
Cloudflare’s default SSL mode is Flexible (or Automatic). In Flexible mode, Cloudflare accepts HTTPS from the browser, but connects to your origin server over plain HTTP on port 80.
Your origin server sees an HTTP request and correctly returns a 301 Moved Permanently redirect to https://yourdomain.com.
Cloudflare follows that redirect - but it is connecting back to itself. It sends another HTTP request to the origin. The origin redirects again. Infinite loop.
The browser aborts with ERR_SSL_PROTOCOL_ERROR.
The Fix
The issue is entirely in Cloudflare, not your server. Your server is working correctly.
- Go to Cloudflare dashboard → SSL/TLS → Overview
- Change the mode from Flexible or Automatic to Full (strict)
- Enable Always Use HTTPS under Edge Certificates
- Set minimum TLS version to TLS 1.2
That’s it. Full (strict) mode forces Cloudflare to connect to your origin over HTTPS and verify the origin certificate. No more loop.
The Rule
Whenever your origin server has its own valid SSL certificate and forces HTTP to HTTPS redirects, Cloudflare must be set to Full (strict). Flexible mode is only for origins with no SSL certificate at all. If you have a Let’s Encrypt cert, you should never be on Flexible mode.
Related reading:
- Supabase pgvector: Fixing the RPC Error
- AI Infrastructure Lessons Learned
- AI Ecosystem Security Principles
Found this useful? Check out the Learn section for structured micro-lessons on building AI systems, or read more on the blog for more practical guides.
Find me across the web
Stay curious, my AI friend. It's the secret sauce - think like you are seven. - Ryan