A bit off topic, but I find it quite disheartening that cloudflare has regular blog posts about how great their security is and how safe you are with cloudflare, but at the same time offers customers seriously broken SSL options.
2 of the 3 options ("Universal SSL" and "Full SSL") are not "secure" by today's standards. Universal SSL leaves connections to the origin unsecured allowing for passive and active MITM attackers to intercept things. Full SSL allows an active MITM to intercept origin connections.
Advertising these services as "SSL" is misleading and offers a false sense of security to visitors as they will see the nice green SSL lock and think their connection to a cloudflare-protected website is fully protected. Meanwhile their credit card information and other personal details could be travelling over the internet in plain text to the origin.
2 of the 3 options ("Universal SSL" and "Full SSL") are not "secure" by today's standards. Universal SSL leaves connections to the origin unsecured allowing for passive and active MITM attackers to intercept things. Full SSL allows an active MITM to intercept origin connections.
Advertising these services as "SSL" is misleading and offers a false sense of security to visitors as they will see the nice green SSL lock and think their connection to a cloudflare-protected website is fully protected. Meanwhile their credit card information and other personal details could be travelling over the internet in plain text to the origin.