Does HTTPS guarantee end-to-end encryption to your origin server?

Does HTTPS guarantee end-to-end encryption to your origin server?

"My site is HTTPS, so traffic is encrypted all the way to my server" quietly ignores where TLS terminates. TLS (Transport Layer Security) secures a connection between two endpoints. When you sit behind a CDN, reverse proxy, or load balancer, the certificate the browser validates belongs to that edge — TLS terminates there. What happens on the second hop, from edge to origin, is a separate connection with its own (or no) encryption.

The common misconfiguration is exactly this back-half. Cloudflare's "Flexible SSL" mode, for years a default-easy option, encrypts browser-to-edge but speaks plain HTTP from edge to origin. The padlock is green; the origin leg is cleartext, readable by anything on the path between the CDN and your host. The browser cannot see past the termination point, so the user has no signal.

The fix is to require encryption on both legs — "Full (strict)" mode with a valid origin certificate — and ideally an authenticated origin pull so only the CDN can reach the origin.

— TLS terminates at the edge, not your origin
— Edge-to-origin is a separate, possibly cleartext leg
— Use Full (strict) plus origin authentication

Further reading: Cloudflare SSL/TLS encryption modes documentation.
Bottom line: HTTPS proves encryption to the termination point, not to your origin. Encrypt and authenticate every hop behind the edge.