Cloudflare Docs
Edit this page
Report an issue with this page
Log into the Cloudflare dashboard
Set theme to dark (⇧+D)

Limitations for Universal SSL

Universal SSL certificates are limited by the hostnames they cover and the browsers they support.

​​ Hostname coverage

​​ Full setup

Universal SSL certificates only support SSL for the root or first-level subdomains such as and To enable SSL support on second, third, and fourth-level subdomains such as or, you can:

​​ CNAME setup

On a CNAME setup zone, each subdomain has its own Universal SSL certificate and does not require additional features or purchases.

​​ Browser support

For more on browser support, see Browser compatibility.

​​ Spectrum

Universal SSL is not compatible with Cloudflare Spectrum. If you are trying to use Spectrum, use either an advanced certificate or a custom certificate.

​​ Certificate authority

For Universal SSL certificates, Cloudflare chooses the certificate authority (CA) used for your certificate.

Cloudflare can change the certificate authority without prior notification, and will not send any notification as the change happens.

If you want to choose the issuing certificate authority, order an advanced certificate.