Skip to content
Cloudflare Docs

Manage certificates

Refer to the following sections to learn how to manage certificates used with the different Authenticated Origin Pulls setups.

Expired certificates

Client certificates are not deleted from Cloudflare upon expiration unless a delete request is sent to the Cloudflare API. However, requests are dropped at your origin if your origin only accepts a valid client certificate.

Make sure you have notifications set up to get alerts 30 days and 14 days before an AOP certificate expires.

Use specialized certificates

To apply different client certificates simultaneously at both the zone and hostname level, you can combine zone-level and per-hostname custom certificates.

First, set up zone-level pulls using a certificate. Then, upload multiple, specialized certificates for individual hostnames. Since per-hostname certificates are more specific, they take precedence over zone certificates.

Replace a certificate without downtime

Per-hostname

  1. Upload the new certificate.
  2. List your certificates and note the ID for the certificate you uploaded.
  3. Enable Authenticated Origin Pulls for the specific hostname, using the ID obtained in step 2 to specify the certificate you want to use:

Required API token permissions

 At least one of the following token permissions is required:
  • SSL and Certificates Write
Enable or Disable a Hostname for Client Authentication
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/origin_tls_client_auth/hostnames" \
  --request PUT \
  --header "X-Auth-Email: $CLOUDFLARE_EMAIL" \
  --header "X-Auth-Key: $CLOUDFLARE_API_KEY" \
  --json '{
    "config": [
        {
            "enabled": true,
            "hostname": "<HOSTNAME>",
            "cert_id": "<CERT_ID>"
        }
    ]
  }'

Zone-level

  1. Upload the new certificate.
  2. Check whether new certificate is Active.
  3. Once certificate is active, delete the previous certificate.