Cloudflare Automatic SSL/TLS or Custom: Which Should a Small Business Use?
Should a small business use Cloudflare Automatic SSL/TLS or keep a Custom encryption mode?
Automatic SSL/TLS is the sensible low-maintenance choice when you want Cloudflare's Recommender to evaluate the current mode, origin certificate and origin capabilities and select a secure mode. Cloudflare also checks for 5XX errors such as 502 or 503 and inconsistent HTTP and HTTPS content before an upgrade. Choose Custom only when you have a specific, documented reason to retain manual control, and assign someone to review that decision.
What Automatic SSL/TLS decides
Cloudflare says Automatic SSL/TLS uses its SSL/TLS Recommender to select the most secure encryption mode for a website. Cloudflare says the Recommender evaluates the current encryption mode, origin certification and origin capabilities when automatically adjusting domain settings. Choose Automatic SSL/TLS when low-maintenance mode selection is the business priority and the team wants Cloudflare to use those documented inputs.
Sources: Encryption modes · Cloudflare SSL/TLS docs.
- Automatic SSL/TLS uses Cloudflare’s Recommender.
- The documented inputs include current mode, origin certification and origin capabilities.
- Use automatic control when low-maintenance operation is the priority.
What Cloudflare checks before an upgrade
Cloudflare checks for 5XX errors such as 502 or 503 and evaluates HTTP and HTTPS content consistency before upgrading a zone’s encryption mode. Treat those checks as documented safeguards for an upgrade decision, not as a promise that every configuration change will be disruption-free. Keep an accountable person aware of the selected control model so the business can reassess it when relevant origin conditions change.
Sources: Encryption modes · Cloudflare SSL/TLS docs.
- Cloudflare checks for specified 5XX errors before upgrades.
- Cloudflare evaluates HTTP and HTTPS content consistency before upgrades.
- Do not interpret these checks as a universal availability guarantee.
When retaining manual control may be reasonable
Retain a Custom setting only when the business can state a concrete reason for manual control, name an accountable owner and define a review trigger. A vague preference to leave settings untouched is not a useful operating reason because it does not tell another responsible person what should be reviewed. These are Hallermann Consulting management recommendations, rather than assertions that Cloudflare requires a particular owner or review process.
- A Custom setting needs a stated reason, not a preference without ownership.
- Name one accountable owner for manual control.
- Define a review trigger that makes the decision revisitable.
Choose an owner and review trigger
Create one control record with the selected model, the reason for that model, one accountable owner and a clearly stated review trigger. A known origin or certificate change is a sensible recommended trigger for reviewing whether Automatic or Custom control still fits the website. Before a service-affecting change, confirm Cloudflare’s current prerequisites in its documentation because this worksheet is not a complete configuration procedure.
- Record the model, reason, owner and trigger in one row.
- Use a known origin or certificate change as a recommended trigger.
- Review the record before a setting change rather than assuming it remains appropriate.
Automatic-versus-Custom control worksheet
Use one row for the website or origin group being governed. The worksheet makes the choice, reason, owner, trigger and next decision visible together.
| Control model | Reason for choice | Accountable owner | Review trigger | Decision after review |
|---|---|---|---|---|
| Automatic SSL/TLS | Low-maintenance management using Cloudflare’s documented origin evaluation | ________________ | Known origin or certificate change | Keep Automatic / move to Custom / needs verification |
| Custom | Specific documented reason for manual control: ________________ | ________________ | ________________ | Keep Custom / move to Automatic / needs verification |
The review triggers are practical recommendations, not documented Cloudflare requirements. Confirm current Cloudflare prerequisites before changing a live setting.
Related guidance
What follow-up questions matter most?
- What does Automatic SSL/TLS use to make its decision?
- Cloudflare says Automatic SSL/TLS uses its Recommender to select the most secure mode and evaluates the current encryption mode, origin certification and origin capabilities when adjusting settings.
- What checks happen before an upgrade?
- Cloudflare documents checks for 5XX errors, including 502 and 503, and for consistency between HTTP and HTTPS content before an upgrade. Do not treat those checks as a guarantee that every change is risk-free.
- When should a business keep Custom control?
- Keep Custom only when the business can state a concrete reason for manual control, name an accountable owner and define a review trigger. Those are practical management recommendations, not Cloudflare requirements.
What steps does this workflow follow?
Choose Automatic or Custom SSL/TLS control
- Describe the operating priority: Record whether low-maintenance mode management or a specific manual-control reason is the current priority. Keep the explanation clear enough for another responsible person to understand.
- Choose the control model: Select Automatic SSL/TLS when Cloudflare should evaluate the mode using origin information. Select Custom only when a concrete reason for manual control can be documented.
- Assign accountability: Record one accountable owner for the chosen control model. The owner should be able to explain the choice and initiate a review when the trigger occurs.
- Define a review trigger: Record a relevant event, such as a known origin or certificate change, as a recommended review trigger. Before changing a live setting, check Cloudflare's current documentation.