[SSL] More details on cert expiration and renewal #18290
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Deploying cloudflare-docs with
|
| Latest commit: |
d2da0a3
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://194e312d.cloudflare-docs-7ou.pages.dev |
| Branch Preview URL: | https://rebecca-ssl-review-renewal-i.cloudflare-docs-7ou.pages.dev |
Contributor
Oxyjun
reviewed
Nov 26, 2024
| ## Upload a custom certificate | ||
|
|
||
| :::caution | ||
| When using `compatible` or `modern` [bundling](/ssl/edge-certificates/custom-certificates/bundling-methodologies), make sure to upload only the leaf certificate. This will allow Cloudflare to properly handle [intermediate and root certificates expiration](/ssl/edge-certificates/custom-certificates/bundling-methodologies/#intermediate-and-root-certificates). |
Contributor
There was a problem hiding this comment.
Suggested change
| When using `compatible` or `modern` [bundling](/ssl/edge-certificates/custom-certificates/bundling-methodologies), make sure to upload only the leaf certificate. This will allow Cloudflare to properly handle [intermediate and root certificates expiration](/ssl/edge-certificates/custom-certificates/bundling-methodologies/#intermediate-and-root-certificates). | |
| When using `compatible` or `modern` [bundling](/ssl/edge-certificates/custom-certificates/bundling-methodologies), make sure to upload only the leaf certificate. This will allow Cloudflare to properly handle [intermediate and root certificate expiration](/ssl/edge-certificates/custom-certificates/bundling-methodologies/#intermediate-and-root-certificates). |
Or, "certificates' expiration"?
Oxyjun
reviewed
Nov 26, 2024
| Universal certificates issued by Let's Encrypt, Google Trust Services, or SSL.com have a 90-day validity period. Cloudflare no longer uses DigiCert for newly issued Universal certificates and, for existing ones, the validity period is being adjusted from one year to 90 days. | ||
| Universal certificates issued by Let's Encrypt, Google Trust Services, or SSL.com have a 90-day validity period. Cloudflare no longer uses DigiCert for newly issued Universal certificates and, for existing ones, the validity period is being adjusted from one year to 90 days. | ||
|
|
||
| For 90-days certificates, the auto renewal period starts 30 days before expiration. |
Contributor
There was a problem hiding this comment.
Suggested change
| For 90-days certificates, the auto renewal period starts 30 days before expiration. | |
| For 90-day certificates, the auto renewal period starts 30 days before expiration. |
Oxyjun
approved these changes
Nov 26, 2024
harshil1712
pushed a commit
that referenced
this pull request
Dec 3, 2024
* Add note about leaf cert and Cf handling of chain expiration * Link to cert-validity-periods from USSL glossary definition * Fix typo and spell out auto renewal 30 days before expiration * Add link from index and enable-universal-ssl for discoverability * Add mention to DCV in relation to renewal as well * Process PCX review suggestions
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
PCX-9284: Call out that for CF to handle intermediate or root expiration, customer must upload leaf only
PCX-10127: More clarity around Universal SSL renewal
Documentation checklist