Skip to content
Cloudflare Docs

Manage certificates

Refer to the following sections to learn how to manage certificates used with the different Authenticated Origin Pulls setups.

Expired certificates

Cloudflare does not delete client certificates upon expiration unless you send a delete request to the Cloudflare API for the relevant certificate (Delete a zone-level certificate or Delete a hostname-level certificate). If your origin only accepts a valid client certificate, it will drop requests when the certificate expires.

Make sure you have notifications set up to get alerts 30 days and 14 days before an AOP certificate expires.

Use specialized certificates

To apply different client certificates simultaneously at both the zone and hostname level, you can combine zone-level and per-hostname custom certificates.

First, set up zone-level pulls using a certificate. Then, upload multiple, specialized certificates for individual hostnames. Since per-hostname certificates are more specific, they take precedence over zone certificates.

Replace a certificate without downtime

Per-hostname

  1. Upload the new certificate.
  2. List your certificates and note the ID for the certificate you uploaded.
  3. Enable Authenticated Origin Pulls for the specific hostname, using the ID obtained in step 2 to specify the certificate you want to use:

Required API token permissions

 At least one of the following token permissions is required:
  • SSL and Certificates Write
Enable or Disable a Hostname for Client Authentication
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/origin_tls_client_auth/hostnames" \
  --request PUT \
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
  --json '{
    "config": [
        {
            "enabled": true,
            "hostname": "<HOSTNAME>",
            "cert_id": "<CERT_ID>"
        }
    ]
  }'

Zone-level

  1. Upload the new certificate.
  2. Check whether new certificate is Active.
  3. Once certificate is active, delete the previous certificate.