What is the difference between 'Full' and 'Full (Strict)' SSL/TLS encryption modes when terminating TLS via Cloudflare Tunnel?

Both 'Full' and 'Full (Strict)' modes ensure that Cloudflare connects to your origin server via HTTPS through the tunnel. The key difference lies in certificate validation. In 'Full' mode, Cloudflare encrypts the connection to your origin but *does not validate* the origin server's SSL certificate. This means it will accept self-signed certificates or certificates that are expired or don't match the hostname. In contrast, 'Full (Strict)' mode encrypts the connection to your origin and *fully validates* the origin server's SSL certificate, ensuring it's valid, not expired, signed by a trusted Certificate Authority, and matches the hostname. 'Full (Strict)' provides the highest level of security for the Cloudflare-to-origin segment of the connection.