Update limitations.mdx

Clarify that Cloudflare SSL/TLS will only work for a subdomain if the DNS record is proxied

Author: simon-says

src/content/docs/ssl/edge-certificates/universal-ssl/limitations.mdx

@@ -14,6 +14,10 @@ import { GlossaryTooltip } from "~/components"
 
 Universal SSL certificates present some limitations.
 
+## Proxy Status
+
+Cloudflare can only serve an SSL/TLS certificate for a DNS record when you set the record's [Proxy Status](/dns/proxy-status/) to Proxied. If you do not do this, the origin server your record points to will be responsible for supporting SSL/TLS connections.
+
 ## Hostname coverage
 
 ### Full setup
@@ -60,4 +64,4 @@ Due to internal limitations, Universal SSL certificates do not cover [load balan
 
 ## Browser support
 
-For more on browser support, see [Browser compatibility](/ssl/reference/browser-compatibility/).
+For more on browser support, see [Browser compatibility](/ssl/reference/browser-compatibility/).