title: s3 and cloudflare flexible ssl handshakes
body: <p>I'm wondering how secure this configuration is. So I have two servers, one for the frontend which serves a compiled static spa, and one for the backend which acts as an api. Each have their own cert from letsencrypt. </p>
  
  <p>I'm trying to run my frontend and s3 virtualhost (cdn.website.com - cname) through cloudflare.</p>
  
  <p>So from what I understand with the flexible, there's encryption between the user and cloudflare, but there's no encryption between cloudflare and the server. So when people hit the site, they are using a cached version of the site on cloudflare. So this is secure. So is the insecure part when cloudflare needs to pull the asset from my server? If my server has a certificate, would cloudflare use sslwhen retrieving it?</p>
  
  <p>So in the above, the ssl connection to cloudflare is secure, so where does it become insecure when talking to my server? Since I don't have my api server's dns on cloudflare, would this still end being sent over ssl/tls? </p>
  
  <p>For the images, why does ssl appear when using flexible, but gives an error when using full? Is this due to the original pull from amazon being insecure, but once cached on cloudflare, it becomes secure as people only hit cloudflare? What are the implications, or how insecure, is doing such?</p>
  
  <p>I guess I'm confused on A) where/when are the handshakes occuring, and B) how are these handshakes occuring?</p>