Refer to the documentation
Cloudflare's docs are fairly clear on this. Obviously (it should be obvious) Flexible ssl means the connection from cloudflare to the origin is unencrypted.
![Cloudflare's ssl image](../../images/3819244677.webp)
For full ssl (either permutation) the following applies:
Encrypts the connection between your site visitors and CloudFlare, and from CloudFlare to your server.
They are two different connections, So the answer to "Does cloudflare know the decrypted content?" is: "Yes".
Note that for EV or OV SSL certificates - you need to uploaded them to to cloudflare for end-users to see them, it's still 2 connections - not end-to-end encryption.
Reasons to use SSL
Using ssl prevents MITM attacks, it doesn't mean the cdn you're using is oblivious to the content it's serving, for you. You should maybe ask yourself why you want to encrypt the connection.
With no SSL, there are plenty of places a MITM attack can occur:
![No ssl, lots of possible attack points](../../images/3784969277.webp)
With Flexible SSL - that eliminates most, but not all of them:
![Flexible ssl, only one attack point now](../../images/3803515999.webp)
With Full SSL - there's still the possibility of a MITM attack:
![Full ssl, one attack point but now harder](../../images/3838971051.webp)
With Full SSL (Strict) - a MITM attack is now not possible without cloudflare itself being compromised:
![Full SSL - no attack possible](../../images/3820162188.webp)
If you are concerned that cloudflare can read your data - don't use cloudflare.