I wonder how it&#x27;s even allowed for CF to do this. &quot;your site&quot; &lt;--- http ---&gt; CF &lt;--- https ---&gt; clients is a poor solution and it only hides that the connection is actually not secure. Isn&#x27;t this a misuse of many CA&#x27;s TOS and should result in certificate revocation? Maybe I&#x27;m wrong though.