Skip to content
Cloudflare Docs
The default global Cloudflare root certificate will expire on 2025-02-02. If you installed the default Cloudflare certificate before 2024-10-17, you must generate a new certificate and activate it for your Zero Trust organization to avoid inspection errors.

User-side certificates

Advanced security features such as HTTPS traffic inspection, Data Loss Prevention, anti-virus scanning, Access for Infrastructure, and Browser Isolation require users to install and trust a root certificate on their device. You can either install the certificate provided by Cloudflare (default option), or generate your own custom certificate and upload it to Cloudflare.

Gateway generates a unique root CA for each Zero Trust account and deploys its across the Cloudflare global network. Alternatively, Enterprise users can upload and deploy their own custom certificate.

Certificate status

Zero Trust will indicate if a certificate is ready for use in inspection based on its deployment status:

Deployment statusDescription
InactiveThe certificate has been generated by or uploaded to Cloudflare but is not deployed across the global network.
PendingThe certificate is being activated or deactivated for use.
ActiveThe certificate is deployed across the Cloudflare global network and ready to be turned on.
Active and In-UseThe certificate is turned on. Gateway will use the certificate for inspection.

Generate a Cloudflare root certificate

To generate a new Cloudflare root certificate for your Zero Trust organization:

  1. In Zero Trust ↗, go to Settings > Resources.
  2. In Certificates, select Manage.
  3. Select Generate certificate.
  4. Choose a duration of time before the certificate expires. Cloudflare recommends expiration after five years. Alternatively, choose Custom and enter a custom amount in days.
  5. Select Generate certificate.

The certificate will appear in your list of certificates as Inactive. To download a generated certificate, select it, then choose Download .pem and/or Download .crt. To deploy your certificate and turn it on for inspection, you need to activate the certificate.

Each Zero Trust account can generate a new root certificate a maximum of three times per day.

Activate a root certificate

Once a certificate is generated in or uploaded to Zero Trust, you need to activate it. Activating a certificate deploys it across the Cloudflare network. You can have up to 25 active certificates at once.

To activate your root certificate:

  1. In Zero Trust ↗, go to Settings > Resources.
  2. In Certificates, select Manage.
  3. Select the certificate you want to activate.
  4. Select Activate.

The status of the certificate will change to Pending while it deploys. Once the status of your certificate is Active, you can turn the certificate on for use in inspection:

  1. In Zero Trust ↗, go to Settings > Resources.
  2. In Certificates, select Manage.
  3. Select the certificate you want to turn on.
  4. In Basic information, select Confirm and turn on certificate.

You can set multiple certificates to Active, but you can only turn on one certificate for use in inspection at a time. Setting a certificate as In-Use will set any other turned on certificates as Active and prevent them from being used for inspection until turned on again.

Once you deploy your certificate across Cloudflare and turn it on, you can install it on your user’s devices either with WARP or manually.

Cloudflare DashboardDiscordCommunityLearning CenterSupport Portal
Cookie Settings