enable-universal-ssl.md

pcx_content_type	title	weight
how-to	Enable Universal SSL certificates	2

Enable Universal SSL certificates

{{}}

The process for activating a Universal SSL certificate depends on your domain's DNS setup.

Full DNS setup

{{}}

Minimize downtime

If your website or application is already live and cannot be uncovered while the Universal certificate is provisioned, consider the following:

• Order an advanced certificate before proxying traffic to Cloudflare.
• Upload a custom certificate prior to migrating and then delete the certificate after your Universal certificate is active.
• Keep DNS records unproxied until your certificate is active.

{{

}}If your domain is using a partial setup, you will need to add Domain Control Validation (DCV) records to your authoritative DNS.{{}}

Partial DNS setup

For non-authoritative or partial domains, Universal SSL will be:

• Provisioned once the DNS record is proxied through Cloudflare.

• Validated:

  • Immediately if you add Domain Control Validation (DCV) records to your authoritative DNS.
  • After a brief period of downtime if you do not add DCV records (once your traffic is proxied).

Unless you cover and validate multiple subdomains with an advanced certificate, you will need to proxy and validate new subdomains as they are added.

Verify your certificate is active

Once you enable Universal SSL, you can review the activation status in the dashboard at SSL/TLS > Edge Certificates or via the API with a GET request.