We give customers a certificate signed against our CA to secure the CloudFlare to origin server connection.

You do? Last I checked, I just saw that you had the option to put a self-signed cert on your own server, but no way to tell CloudFlare to validate it (e.g.: I couldn't upload my public cert to CF and say "this is what you should expect"). Alternatively, I could buy my own valid cert and put it on the server. Is the option to get a valid signed cert from CF new?

Did this actually come out?

I've never seen the option in the panel for this, and as far as I know only a handful of users got accepted into the 'beta'.

Hmm, I use your TLS cert but I didn't see the CA-signed one I can use. I'll read the blog post below, thanks.

Cloudflare has a few options you can choose from for cloudflare<=>origin connections. I've tried them all out and they've worked as advertised as far as I could tell:

I set up Cloudflare with their "Strict" SSL option, which requires that my origin servers use a valid TLS certificate. I paid the CA toll to get a cert for my site, and I use that cert to serve connections from Cloudflare's servers.

They also have a "Full" option, which allows you to use a self-signed cert (with no validation -- you might be able to require validation of self-signed certs if you're on a paid plan) on your origin servers, which is slightly more secure than the "Flexible" option, which uses HTTP (with no encryption) when connecting to the origin server, even though it then serves the content to end users over HTTPS with their own (valid) cert.

I use a self signed cert between CloudFlare and my server, I actually couldn't get it to work without doing that, for some reason.