Renewal and expiration
Renew custom certificates
If a valid replacement - covering some or all of the SANs in the expiring custom certificate - is already available, Cloudflare will remove the expiring custom certificate in the 24 hours before expiration. There is no expected downtime due to certificate transition.
If no valid replacement is available, Cloudflare will remove the custom certificate after it expires.
Affected domains and subdomains will fall back to any other active certificate covering the hostnames on the expiring certificate.
Migrate to other certificate types
If you no longer want to use your custom certificate but still want your website or application to be covered with SSL/TLS, you can do the following: