Troubleshooting
You can use an external tool such as the SSLShopper Certificate Key Matcher ↗ to check your certificate and make sure the key matches.
Alternatively, use openssl to verify the match by comparing the public key hash of both files. This method works for both RSA and ECDSA certificates:
openssl x509 -noout -pubkey -in certificate.crt | openssl md5openssl pkey -pubout -in private.key | openssl md5If the two outputs match, the certificate and key are a valid pair.
You can use openssl to check all the details of your certificate:
openssl x509 -in certificate.crt -noout -textThen, make sure all the information is correct before uploading.
Cloudflare does not accept password-protected private keys. If your private key requires a password, remove it before uploading. The following command works for both RSA and ECDSA keys:
openssl pkey -in protected.key -out unprotected.keyUse the unprotected.key file when uploading to Cloudflare. For detailed instructions, refer to Remove key file password.
Private keys must be in one of the following unencrypted formats:
- PKCS#8
- PKCS#1
- Elliptic Curve
If you move a domain without deleting the custom certificate from the previous zone, the certificate may still take precedence and be presented to your visitors, until the previous zone is deleted.
Refer to Move a domain between Cloudflare accounts for details.
As Let's Encrypt - one of the certificate authorities (CAs) used by Cloudflare - has announced changes in its chain of trust, you may face issues.
If you are using a Let's Encrypt certificate uploaded by yourself as a custom certificate, consider the following:
- If you use compatible or modern bundle method and have uploaded your certificate before September 9, 2024, update your custom certificate so that it can be bundled with the new chain.
- If you use user-defined bundle method, make sure that your certificates uploaded after September 30, 2024, do not use the Let's Encrypt cross-signed chain.
Root cause
The certificate you are trying to upload is invalid. For example, there might be extra lines, or the BEGIN/END text is not correct, or extra characters are added following a copy/paste.
In the case of an update with the PATCH API call, it can mean the path parameter {custom_certificate_id} is invalid.
Solution
Carefully check the content of the certificate. You may use openssl to check all the details of your certificate:
openssl x509 -in certificate.crt -noout -textWhen using the API, carefully check the {custom_certificate_id} path parameter. You can confirm the certificate ID by listing the existing custom certificates (id in the response).
Root cause
You have used up your custom certificate quota.
Solution
Delete some existing certificates to add a new one. If you are an Enterprise customer, you can contact your account team to acquire more custom certificates.
Root cause
You are trying to upload a custom certificate that you have already uploaded.
Solution
Delete the existing one and try again.
Root cause
A custom certificate pack can only have one certificate per signature algorithm (for example, one RSA and one ECDSA certificate).
Solution
Instead of uploading a new certificate, update the existing certificate using the edit option in the dashboard or the PATCH API endpoint.
Root cause
This error occurs when there is an issue with the certificate pack structure. You must delete other certificates in the pack before deleting this one.
Solution
Delete the other certificates in the certificate pack first, then delete this certificate. If the issue persists, contact Cloudflare Support.
Root cause
You are trying to upload a certificate to the custom origin trust store, but the certificate is not a valid root CA certificate.
Solution
When creating a self-signed root CA certificate, ensure you use the -extensions v3_ca option with OpenSSL. Refer to this community post ↗ for more details.
The SSL attribute is invalid. Please refer to the API documentation, check your input and try again. (Code: 1434)
Root cause
You are trying to upload a custom certificate that does not support any cipher that is needed by Chromium-based browsers.
Solution
Modify the certificate so that it supports chromium-supported ciphers and try again.
Root cause
The quota for custom certificates depends on the type of certificate (Custom Legacy vs Custom Modern).
If you try to upload a certificate type but have already reached your quota, you will receive this error.
Solution
First, check your custom certificate entitlements on the Edge Certificates ↗ page.
Then, when actually uploading or editing the certificate, make sure you select the appropriate option for Legacy Client Support.
The certificate chain you uploaded cannot be bundled using Cloudflare's trust store. Please check your input and try again. (Code: 2100)
Root cause
You are trying to upload a custom certificate that contains the root and leaf certificate at the same time.
Solution
Upload the leaf certificate only.
The certificate chain you uploaded has no leaf certificates. Please check your input and try again. (Code: 2101)
Root cause
You are trying to upload a root + intermediate + intermediate .crt file, but the actual leaf certificate is in a separate file.
Solution
Add the leaf to the .crt file, or just use the leaf by itself since the Certificate Authority has a public chain of trust in our trust store.
The certificate chain you uploaded does not include any hostnames from your zone. Please check your input and try again. (Code: 2103)
Root cause
Cloudflare verifies that uploaded custom certificates include a hostname for the associated zone. Moreover, this hostname must be included as a Subject Alternative Name (SAN). This is following the standard set by the CA/Browser Forum ↗.
Solution
Make sure your certificate contains a Subject Alternative Name (SAN) specifying a hostname in your zone. You can use the openssl command below and look for Subject Alternative Name in the output.
openssl x509 -in certificateFile.pem -noout -textIf it does not exist, you will need to request a new certificate.
Root cause
Cloudflare requires separate, pem-encoded files for the SSL private key and certificate.
Solution
Contact your Certificate Authority (CA) to confirm whether your current certificate meets this requirement or request your CA to assist with certificate format conversion.
Make sure your certificate complies with these requirements.
Check that the certificate and private keys match before uploading the certificate in the Cloudflare dashboard. This external resource ↗ might help.
Root cause
The certificate and private key you uploaded do not form a valid pair. The private key does not correspond to the public key in the certificate. This can happen when the wrong key file is selected during upload.
Solution
Ensure the private key corresponds to the certificate you are uploading. You can verify this by comparing the public key hash of both files. This method works for both RSA and ECDSA certificates:
openssl x509 -noout -pubkey -in certificate.crt | openssl md5openssl pkey -pubout -in private.key | openssl md5If the outputs do not match, you have mismatched the certificate and key.
Root cause
An internal error occurred while processing your request.
Solution
Wait a few minutes and try again. If the issue persists, contact Cloudflare Support with a HAR file capturing the failed upload attempt.