Custom Domain Integration: Routing Blogger Through Cloudflare Without SSL Handshake Failures

Problem Overview

When setting up a custom domain on Blogger through Cloudflare DNS and proxying traffic (Orange Cloud enabled), users often experience SSL/TLS handshake failures (e.g., ERR_SSL_VERSION_OR_CIPHER_MISMATCH, Cloudflare Error 525/526, or redirect loops).

Root Cause Analysis

1. SSL/TLS Encryption Mode Mismatch: Setting Cloudflare's SSL mode to 'Flexible' causes redirect loops (HTTP <-> HTTPS), while 'Full (Strict)' can fail if Blogger's origin HTTPS certificate isn't fully provisioned or recognized by Cloudflare yet.

2. Missing Google Verification Records: Blogger requires two CNAME records (www -> ghs.googlehosted.com and a unique verification CNAME) alongside Google's four A records for root domain routing.

3. Google Managed SSL Certificate Delay: Blogger's automatic SSL certificate generation requires domain validation via DNS before Google provisions the TLS cert for the custom domain.

Step-by-Step Resolution Strategy

1. Configure DNS Records in Cloudflare: Add four A records pointing to Google IPs (216.239.32.21, 216.239.34.21, 216.239.36.21, 216.239.38.21) and the required CNAME records.

2. Set Cloudflare SSL/TLS Mode to Full (Strict): Ensures secure encrypted communication between Cloudflare and Google origin servers.

3. Enable HTTPS Availability in Blogger Settings: Toggle HTTPS availability and HTTPS redirect to ON.

4. Temporarily Set Proxy to DNS Only (Grey Cloud) if SSL Fails: Allows Blogger to validate domain ownership and issue its managed SSL certificate without Cloudflare proxy interference.

Verification and Best Practices

1. Test Domain Accessibility: Verify HTTP to HTTPS redirection and check for valid SSL certificates.

2. Re-enable Cloudflare Proxying: Once Blogger's SSL status shows Available, switch Cloudflare records back to Proxied (Orange Cloud) for DDoS protection and CNAME flattening.