Edge certificates

Edge certificates and origin certificates

An edge certificate authenticates the public hostname to visitors connecting to Cloudflare. Cloudflare then creates a separate upstream TLS connection to the origin. Universal SSL, Advanced Certificates and uploaded Custom Certificates affect the edge. A public or Cloudflare Origin CA certificate affects the origin connection.

Universal SSL coverage

Universal SSL is automatically available on Cloudflare plans and uses domain-validated certificates. With a full DNS setup it normally covers the zone apex and first-level subdomains. Deeper names such as api.dev.example.com require suitable additional coverage through Total TLS, an Advanced Certificate or a Custom Certificate.

• Certificate status can be active while a newly added hostname is not covered.
• A certificate is presented only when the hostname is proxied.
• Issuance can take from minutes to 24 hours after activation or a relevant DNS change.

Certificate selection and priority

Cloudflare can hold more than one certificate pack for a hostname and select a compatible certificate during the TLS handshake. RSA provides broad compatibility; ECDSA offers smaller modern handshakes. Keep overlapping coverage during replacement so a renewal or upload does not create a gap.

Full (strict) origin encryption

Full (strict) encrypts both hops and validates the origin certificate's trust, expiry and hostname. Install a publicly trusted or Cloudflare Origin CA certificate on port 443 before enabling strict mode. Full without strict validation encrypts the hop but accepts an invalid origin certificate and should not be the final state.

Custom certificate requirements

A custom certificate must contain the required SAN hostnames, match its private key, use an accepted key type and size, include the correct chain and retain sufficient validity. The customer controls renewal and replacement for an uploaded custom certificate; Cloudflare does not silently renew a customer-owned certificate.

• Never paste a private key into documentation, tickets or logs.
• Validate the certificate and chain before replacing the working pack.
• Keep the old certificate until the new pack is active on every required hostname.

Protocol versions and cipher suites

Minimum TLS Version removes older visitor protocols. TLS 1.3 enables the modern handshake while TLS 1.2 can remain as a fallback. Custom cipher suites are an expert compatibility control: removing a suite can exclude older clients, appliances and integrations even when the certificate itself is valid.

Certificate lifecycle and renewal

Universal certificates normally have short lifetimes and Cloudflare starts renewal before expiry. DNS, CAA and certificate-authority validation must continue to work during renewal. Monitor status rather than only the displayed expiry date, because a pending renewal can reveal a blocked validation path.

Diagnose TLS failures

Identify the failing hop. A browser certificate warning points to edge hostname coverage or trust. Error 525 indicates an origin TLS handshake failure. Error 526 indicates Full (strict) rejected the origin certificate. Confirm proxy state, hostname, certificate chain, expiry, SNI support, port 443 and origin firewall access from Cloudflare.

• Test the public hostname with SNI.
• Test the origin separately only through an authorized administrative path.
• Do not leave strict validation disabled after using a temporary recovery mode.

Safe certificate replacement

Add and activate the replacement before removing the current certificate. Verify the apex, www and every application hostname from more than one client profile. Remove the old pack only after the replacement is consistently served and the origin connection remains healthy.